diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2.json new file mode 100644 index 00000000..ca19475b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2.json @@ -0,0 +1,25 @@ +{ + "parent": "08870d65de615cbb8b5e1f374bf53a2229c21930", + "commit": "4016f3bdeefeb389b59e28722d1e897285dbf3d2", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/cleanup-upload-staging.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execute-verify.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/final-readonly-dry-run.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/frozen-native-argv.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/local-fixture-results.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/process_supervision.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-baseline.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-to-r3-supervisor.patch", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-zombie-counterexample.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/reproduce-r2.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/retained-fixture-refinement.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/runtime.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/source-contract-pins.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/test_process_supervision.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/test_receipt_cleanup.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/verify-installed.py" + ], + "commit_exit_code": 0, + "stdout": "[main 4016f3b] Record failed runtime trial and reviewed verification proposal (3/4)\n 16 files changed, 1426 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/cleanup-upload-staging.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execute-verify.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/final-readonly-dry-run.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/frozen-native-argv.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/local-fixture-results.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/process_supervision.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-baseline.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-to-r3-supervisor.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-zombie-counterexample.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/reproduce-r2.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/retained-fixture-refinement.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/runtime.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/source-contract-pins.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/test_process_supervision.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/test_receipt_cleanup.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/verify-installed.py\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 16, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3-consistency.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3-consistency.json new file mode 100644 index 00000000..b2a89133 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3-consistency.json @@ -0,0 +1,120 @@ +{ + "repo_slug": "the-custodian", + "repo_path": "/home/worsch/the-custodian", + "source_revision": "c034f59befba077ed6c0e2bfc8679aa648aa9ed6", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry", + "file_path": "workplans/ADHOC-2026-08-25-retired.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md", + "db_id": "", + "file_value": "STATE-WP-0092", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved", + "file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05", + "db_id": "", + "file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate", + "file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06", + "db_id": "", + "file_value": "needs_human: true", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "370c2481-6806-41eb-a917-f8874f03184f", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform", + "file_path": "workplans/THE-WP-0001-federation-interface.md", + "db_id": "", + "file_value": "THE-WP-0001", + "db_value": "CUST-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 89/89", + "C-17 cleared: pushed 1 backlogged commit(s)", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 6, + "info": 4 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3-consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3-consistency.stderr.txt new file mode 100644 index 00000000..047afc64 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3-consistency.stderr.txt @@ -0,0 +1 @@ +WARN: working-memory commit failed: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3-projection.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3-projection.json new file mode 100644 index 00000000..6224f92e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3-projection.json @@ -0,0 +1,292 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "the-custodian", + "commit": "c034f59befba077ed6c0e2bfc8679aa648aa9ed6", + "requests": 2, + "elapsed_ms": 9079.3, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "the-custodian", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [ + { + "kind": "workplan", + "id": "CUST-WP-ADHOC-2026-08-25-RETIRED", + "source": "workplans/ADHOC-2026-08-25-retired.md" + } + ], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "c034f59befba077ed6c0e2bfc8679aa648aa9ed6", + "derived_commit": "c034f59befba077ed6c0e2bfc8679aa648aa9ed6", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "the-custodian", + "commit": "c034f59befba077ed6c0e2bfc8679aa648aa9ed6", + "status": "applied", + "counts": { + "created": 0, + "updated": 88, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 0, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 13 + }, + "created": [], + "updated": [ + "CUST-WP-0000", + "CUST-WP-0000b", + "CUST-WP-0000c", + "CUST-WP-0001", + "CUST-WP-0002", + "CUST-WP-0004", + "CUST-WP-0005", + "CUST-WP-0006", + "CUST-WP-0007", + "CUST-WP-0008", + "CUST-WP-0009", + "CUST-WP-0010", + "CUST-WP-0010b", + "CUST-WP-0013", + "CUST-WP-0014", + "CUST-WP-0015", + "CUST-WP-0016", + "CUST-WP-0017", + "CUST-WP-0017-LEGACY", + "CUST-WP-0018", + "CUST-WP-0019", + "CUST-WP-0020", + "CUST-WP-0021", + "CUST-WP-0022", + "CUST-WP-0023", + "CUST-WP-0024", + "CUST-WP-0025", + "CUST-WP-0026", + "CUST-WP-0027", + "CUST-WP-0028", + "CUST-WP-0029", + "CUST-WP-0030", + "CUST-WP-0031", + "CUST-WP-0032", + "CUST-WP-0033", + "CUST-WP-0034", + "CUST-WP-0035", + "CUST-WP-0036", + "CUST-WP-0037", + "CUST-WP-0039", + "CUST-WP-0040", + "CUST-WP-0041", + "CUST-WP-0043", + "CUST-WP-0044", + "CUST-WP-0045", + "CUST-WP-0046", + "CUST-WP-0047", + "CUST-WP-0048", + "CUST-WP-0049", + "CUST-WP-0050", + "CUST-WP-0051", + "CUST-WP-0052", + "CUST-WP-0053", + "CUST-WP-0053-LEGACY", + "CUST-WP-0054", + "CUST-WP-0055", + "CUST-WP-0056", + "CUST-WP-0057", + "CUST-WP-0058", + "CUST-WP-0059", + "CUST-WP-0060", + "CUST-WP-0061", + "CUST-WP-0062", + "CUST-WP-0063", + "CUST-WP-0064", + "CUST-WP-0065", + "CUST-WP-0066", + "CUST-WP-0067", + "CUST-WP-0068", + "CUST-WP-0069", + "CUST-WP-0070", + "CUST-WP-0071", + "CUST-WP-0072", + "CUST-WP-0073", + "CUST-WP-0074", + "CUST-WP-0075", + "CUST-WP-0076", + "CUST-WP-0077", + "CUST-WP-0078", + "CUST-WP-0079", + "CUST-WP-0080", + "CUST-WP-0081", + "CUST-WP-ADHOC-2026-03-29", + "CUST-WP-ADHOC-2026-05-02", + "CUST-WP-ADHOC-2026-07-02", + "CUST-WP-ADHOC-2026-08-25", + "CUST-WP-ADHOC-2026-09-06", + "THE-WP-0001" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [], + "cancelled_tasks": [], + "created_edges": [], + "removed_edges": [], + "unresolved_edges": [], + "external_edges": [ + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T05", + "target": "CUST-WP-0071-T04", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "20ddd4d7-d85d-5b95-bb0a-7b0ca8af76ca", + "to_workplan_id": null, + "to_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T03", + "target": "CUST-WP-0071-T01", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495", + "to_workplan_id": null, + "to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T03", + "target": "CUST-WP-0071-T02", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495", + "to_workplan_id": null, + "to_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T02", + "target": "CUST-WP-0071-T01", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68", + "to_workplan_id": null, + "to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T02", + "target": "RAPPS-WP-0014-T03", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68", + "to_workplan_id": null, + "to_task_id": "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T04", + "target": "CUST-WP-0071-T03", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc", + "to_workplan_id": null, + "to_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495" + }, + { + "workplan": "CUST-WP-0073", + "from": "CUST-WP-0073-T02", + "target": "GLAS-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d", + "from_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35", + "to_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "to_task_id": null + }, + { + "workplan": "CUST-WP-0073", + "from": "CUST-WP-0073-T04", + "target": "CUST-WP-0073-T02", + "relationship_type": "starts_after", + "from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d", + "from_task_id": "90725511-4e31-549f-b567-47feff1a9ca4", + "to_workplan_id": null, + "to_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35" + }, + { + "workplan": "CUST-WP-0079", + "from": "CUST-WP-0079-T03", + "target": "ACTIVITY-WP-0047", + "relationship_type": "blocks", + "from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3", + "from_task_id": "1be0569c-221d-5925-a0ff-fd2af88e52b1", + "to_workplan_id": "ee97869b-dca2-54c9-aa18-0b479c244fb3", + "to_task_id": null + }, + { + "workplan": "CUST-WP-0079", + "from": "CUST-WP-0079-T04", + "target": "PNEX-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3", + "from_task_id": "5dd52156-09a8-5781-b288-99ae822f59a6", + "to_workplan_id": "774c5037-a3d0-5e65-893c-d18970acd66a", + "to_task_id": null + }, + { + "workplan": "CUST-WP-0080", + "from": "CUST-WP-0080-T04", + "target": "CUST-WP-0080-T03", + "relationship_type": "starts_after", + "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "from_task_id": "82378b0f-7004-5c2f-9683-b356a1227576", + "to_workplan_id": null, + "to_task_id": "87637402-02f1-57c1-8fbc-4141598af8e3" + }, + { + "workplan": "CUST-WP-0080", + "from": "CUST-WP-0080-T05", + "target": "RPF-WP-0056", + "relationship_type": "blocks", + "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "from_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b", + "to_workplan_id": "31933d08-c877-5fda-aff9-6220c3705c92", + "to_task_id": null + }, + { + "workplan": "CUST-WP-0080", + "from": "CUST-WP-0080-T05", + "target": "RAPP-PLAYWRIGHT-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "from_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b", + "to_workplan_id": "f9280c40-201e-59b5-a6f0-1aace8e0e2e2", + "to_task_id": null + } + ], + "refused": [], + "notes": [ + "Preserved bound historical row and task UUIDs: CUST-WP-ADHOC-2026-08-25-RETIRED" + ] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3-projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3-projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3.json new file mode 100644 index 00000000..b03d2d7a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-3.json @@ -0,0 +1,26 @@ +{ + "parent": "4016f3bdeefeb389b59e28722d1e897285dbf3d2", + "commit": "c034f59befba077ed6c0e2bfc8679aa648aa9ed6", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/FINAL-PROPOSAL.md", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/approval-decision.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/installed-partial-verification.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/root-review.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/pending-decision.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/checkpoint-progress.json", + ".kaizen/agents/custodian-codex/supervision.json", + "docs/netkingdom-target-implementation.md", + "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approval-decision.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approved-preflight.json", + "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/ASSESSMENT.md", + "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/assessment.json", + "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/current-pins.json", + "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/manifest.json", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/inputs.json", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/publish.py" + ], + "commit_exit_code": 0, + "stdout": "[main c034f59] Record failed runtime trial and reviewed verification proposal (4/4)\n 17 files changed, 1193 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/ASSESSMENT.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/assessment.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/current-pins.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/FINAL-PROPOSAL.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/approval-decision.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/installed-partial-verification.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approval-decision.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approved-preflight.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/checkpoint-progress.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/pending-decision.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/root-review.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/inputs.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/publish.py\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 17, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/inputs-before-key39-review.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/inputs-before-key39-review.json new file mode 100644 index 00000000..ccbb9fc3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/inputs-before-key39-review.json @@ -0,0 +1,250 @@ +{ + "base_commit": "4097a0bfbc42b937f23a06d19d3aa4587c51927f", + "purpose": "Preserve actual failed R2 and exact approved R3/read-only headroom refusal; no R3 native execution inferred", + "batches": [ + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/FINAL-PROPOSAL.md", + "sha256": "sha256:44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/PROCESS-CONTRACT.md", + "sha256": "sha256:ed79d14bde467e8893c341419c37fa2992184597fc9015c2e7d81fb4ece63fd0" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/action-inputs.json", + "sha256": "sha256:ce7f5a25be440561f5179ae9980d85eb693a11b58d2012c8aea24b8bae04ab6f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/artifact-manifest.json", + "sha256": "sha256:aea5dbfe0742fe0bb6c36a41ca7b0d70473683b2731f92cc279d43929e5c35c9" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/build-transfer.py", + "sha256": "sha256:99914629f354d4b6d5a4750850b32ec2cb64ac5ce18e86702d9157ea6f6b0124" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cleanup-upload-staging.py", + "sha256": "sha256:cec7eab2b25e4a0077ec45c055d7ba9542bc8e8724b53f2117be61c913269188" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cpu-readonly-observation.json", + "sha256": "sha256:c424ecb281baf128d6c79f1e6c6f678093f9b5e9c84a3454f9891fe6197b2e95" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/executable-readonly-observation.json", + "sha256": "sha256:3ee73cdeeb4f82a55b31d19c6a24aacc4199e2e8647335d65b4e8f2e7d079c18" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execute-install.py", + "sha256": "sha256:44d93406ce62cc1f08ca9c7deb3eed6f45c74d61efd978f7b0acec31ba04cdc5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json", + "sha256": "sha256:59969ad9992ac289a553e1076209ba0d04b6fa7cd171bfad83dcc1f96d80a1c6" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/final-readonly-dry-run.json", + "sha256": "sha256:17144cdb22f975212ea02a5109c94740c430d79272ef9d919ce57dec68c2d880" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/frozen-native-argv.json", + "sha256": "sha256:0efb13aa725111cc227453bc7fc40eaf039c83cbd291ca7cb0409daf6b1e6c55" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/install-verified.py", + "sha256": "sha256:c6895881b83b3f5d5408c646040368cc5c59a99e1495fa0914b9183e087a6831" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-bytecode-refinement.json", + "sha256": "sha256:08c92506d6abefe15aff4a9b7908ab8bee425e7792abc6095e1dd04101a2a540" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-check.py", + "sha256": "sha256:97fbec826d517b1746a2ec5ef67e5aab053777690977abdddc8b33ec5804e22e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-verification.json", + "sha256": "sha256:2331b854389b4c15f5adce1f62aa0846e9f47dfda351a7ef166c90b5e9b2737c" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/pre-absolute-path-dry-run.json", + "sha256": "sha256:9ea47b71b8636e4beb7dadf595f1d08bde261c9986986a1335d0c00d581a6d0c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process-fixture-results.json", + "sha256": "sha256:fc72ce36758ea40010aeb7c4ce97c167d09784fde63eeb9b2ccaa3428dc9a831" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process_supervision.py", + "sha256": "sha256:4d990ee05003040e74bfdac7b2e49a3ef1512d4a054b3ff2317647b3670dd1bf" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-preservation.json", + "sha256": "sha256:50848ad45fda68f43e11710bb04b0793717a5d0659e3fbcf8003708ee5ccb542" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-to-r2.patch", + "sha256": "sha256:63f35421b67576188ff92d920319a23aa0a6606b9a2137d1061687c77126b541" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r2-initial-readonly-dry-run.json", + "sha256": "sha256:631c6f0d8c0f66f51509751094937fd909821d4f45a042fd77f9d10f237115b8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-headroom-refusal.json", + "sha256": "sha256:89c847b4a75f138ff2464fc8291cf36939d293a777fd41ffd41d72f96ba9a2f8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-local-source-refusal.json", + "sha256": "sha256:fdd3b584da6ebedc173ccc5f8879c42dbd821d4b98338337fbef809a403485ba" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/runtime.py", + "sha256": "sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-addendum.json", + "sha256": "sha256:9588f51b353093d178b8c52892ca627c2317fab761591715a0765603a4182a8f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-observation.json", + "sha256": "sha256:ba4012303e5634686208a818b221113a1a670c31ed29269d8a4cc98308616275" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/test_process_supervision.py", + "sha256": "sha256:7ea89d9dee17d6ac4b554e25c083ac43d9b94039a4bcbe411d0e2ccbfb55a180" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/transfer-archive.json", + "sha256": "sha256:3222ccd39ea968353ea5e58ec36f0e3ca35b608020444243b053074a36abfe0b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md", + "sha256": "sha256:7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/action-inputs.json", + "sha256": "sha256:f37f6263e364e0caf4903a7374203224146f9655e9fec63e04c70b96b4351dbb" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/artifact-manifest.json", + "sha256": "sha256:19d3a74b124a9a7236bd4b8f6fe45656b4651d875017486f0dfa515f3f81d806" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/cleanup-upload-staging.py", + "sha256": "sha256:d007c297d80cffad2b42040d92f8335c6bae8aa13021098256222dea0c76f3d3" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execute-verify.py", + "sha256": "sha256:252cf6dfb5c501bc82259f0370b2912f73b1edfeb60b2d7af9036d4b82588ed5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/final-readonly-dry-run.json", + "sha256": "sha256:d7d273b2df07e919d0a1b35b765d9e6722f9cb215ce91d8553e79326384c5a7d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/frozen-native-argv.json", + "sha256": "sha256:0efb13aa725111cc227453bc7fc40eaf039c83cbd291ca7cb0409daf6b1e6c55" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/local-fixture-results.json", + "sha256": "sha256:339b2fcfd8d407e09874592b681830c605a463a88841351eed494a182d677219" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/process_supervision.py", + "sha256": "sha256:ec08fe309b36e55a0013e73d35b4db3a8eed9cdf32412a923cbafa83f68788c4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-baseline.json", + "sha256": "sha256:caaea4ca1b6bfa7fd765a3f4e5fe556d9484b77eac388af6ff20735d6962f81d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-to-r3-supervisor.patch", + "sha256": "sha256:00f5540bed786b912d8c3ce8aaa3fc012b4cf3eb208edbbe0d15139dcc533c09" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-zombie-counterexample.json", + "sha256": "sha256:c4a81c396e02e3bf372d6cd31f69c8030574576c171c8b455e8ca641106a1f83" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/reproduce-r2.py", + "sha256": "sha256:dce2d3cd5fa2c55a9ad84cbdd5f133d71ea483ada4ba88cc76997640e928de60" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/retained-fixture-refinement.json", + "sha256": "sha256:2d171d188345637a4e862a76ab917a39854c94058338d7c31c8c8ce397d8da51" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/runtime.py", + "sha256": "sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/source-contract-pins.json", + "sha256": "sha256:900475059e62063ea899ef42bc3de9c9edf794c7113b3f4a46491a3984090b6b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/test_process_supervision.py", + "sha256": "sha256:93a6c98ccf971ea18bd5e9efffcc7c5a6b0456540cae9856d1addf5e38a88239" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/test_receipt_cleanup.py", + "sha256": "sha256:1c64e3e68cb42a539e5b63c4137f56ff3d6924840ba4eb9cbfd8bb329f0d0616" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/verify-installed.py", + "sha256": "sha256:846369568edf016e5122e30fdd861f855e77c14713b644ddd175d1181afe6b93" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/FINAL-PROPOSAL.md", + "sha256": "sha256:408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/approval-decision.json", + "sha256": "sha256:ac6d9534d90e8af99af250f716b953b43ca9108f9a06df9567a727ccb6e74be4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/installed-partial-verification.json", + "sha256": "sha256:8da5a42a68a6f21b92a925fe36fe233ac153c2762846a29d0710e368b05f6fff" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/root-review.json", + "sha256": "sha256:bc8016d73bc435a184dbfce881a37bb63b82075a20d3e0c59c6701a2e6bfb35e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/pending-decision.json", + "sha256": "sha256:e0d053b431813a548c94bde0e18f92cd7edffe3764255cb8ba929e6c5113b5ba" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/checkpoint-progress.json", + "sha256": "sha256:b62c553375b4ffd5670297db341c776be8a22b750fbcc77b06a486941c8e2843" + }, + { + "path": ".kaizen/agents/custodian-codex/supervision.json", + "sha256": "sha256:e059610e44c209cc53ed93d5c4c9024d8600ab65df9e20c9ffaddb05efc6e170" + }, + { + "path": "docs/netkingdom-target-implementation.md", + "sha256": "sha256:21f6c0ce470d657756cb219a100c9f6df9b0233dc61dce7f319ccc3aa15e3c45" + }, + { + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md", + "sha256": "sha256:f7fb4d8e2296e66c8f4b072c81c950a7cdc37a9180139d3783bdd11eebb51134" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approval-decision.json", + "sha256": "sha256:5c70349ecbae11451a36c470af76ef0ae09ae419e7e63ae6f7bff8052f64bf83" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approved-preflight.json", + "sha256": "sha256:2530ba1bb93a8581d950c18c92c391ae2009089180f17b77b7e2575e2d018de0" + } + ] + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/inputs-before-r3-approval.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/inputs-before-r3-approval.json new file mode 100644 index 00000000..a9e61085 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/inputs-before-r3-approval.json @@ -0,0 +1,242 @@ +{ + "base_commit": "4097a0bfbc42b937f23a06d19d3aa4587c51927f", + "purpose": "Preserve actual failed R2 trial and pending reviewed R3; no approval inferred", + "batches": [ + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/FINAL-PROPOSAL.md", + "sha256": "sha256:44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/PROCESS-CONTRACT.md", + "sha256": "sha256:ed79d14bde467e8893c341419c37fa2992184597fc9015c2e7d81fb4ece63fd0" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/action-inputs.json", + "sha256": "sha256:ce7f5a25be440561f5179ae9980d85eb693a11b58d2012c8aea24b8bae04ab6f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/artifact-manifest.json", + "sha256": "sha256:aea5dbfe0742fe0bb6c36a41ca7b0d70473683b2731f92cc279d43929e5c35c9" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/build-transfer.py", + "sha256": "sha256:99914629f354d4b6d5a4750850b32ec2cb64ac5ce18e86702d9157ea6f6b0124" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cleanup-upload-staging.py", + "sha256": "sha256:cec7eab2b25e4a0077ec45c055d7ba9542bc8e8724b53f2117be61c913269188" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cpu-readonly-observation.json", + "sha256": "sha256:c424ecb281baf128d6c79f1e6c6f678093f9b5e9c84a3454f9891fe6197b2e95" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/executable-readonly-observation.json", + "sha256": "sha256:3ee73cdeeb4f82a55b31d19c6a24aacc4199e2e8647335d65b4e8f2e7d079c18" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execute-install.py", + "sha256": "sha256:44d93406ce62cc1f08ca9c7deb3eed6f45c74d61efd978f7b0acec31ba04cdc5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json", + "sha256": "sha256:59969ad9992ac289a553e1076209ba0d04b6fa7cd171bfad83dcc1f96d80a1c6" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/final-readonly-dry-run.json", + "sha256": "sha256:17144cdb22f975212ea02a5109c94740c430d79272ef9d919ce57dec68c2d880" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/frozen-native-argv.json", + "sha256": "sha256:0efb13aa725111cc227453bc7fc40eaf039c83cbd291ca7cb0409daf6b1e6c55" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/install-verified.py", + "sha256": "sha256:c6895881b83b3f5d5408c646040368cc5c59a99e1495fa0914b9183e087a6831" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-bytecode-refinement.json", + "sha256": "sha256:08c92506d6abefe15aff4a9b7908ab8bee425e7792abc6095e1dd04101a2a540" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-check.py", + "sha256": "sha256:97fbec826d517b1746a2ec5ef67e5aab053777690977abdddc8b33ec5804e22e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-verification.json", + "sha256": "sha256:2331b854389b4c15f5adce1f62aa0846e9f47dfda351a7ef166c90b5e9b2737c" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/pre-absolute-path-dry-run.json", + "sha256": "sha256:9ea47b71b8636e4beb7dadf595f1d08bde261c9986986a1335d0c00d581a6d0c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process-fixture-results.json", + "sha256": "sha256:fc72ce36758ea40010aeb7c4ce97c167d09784fde63eeb9b2ccaa3428dc9a831" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process_supervision.py", + "sha256": "sha256:4d990ee05003040e74bfdac7b2e49a3ef1512d4a054b3ff2317647b3670dd1bf" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-preservation.json", + "sha256": "sha256:50848ad45fda68f43e11710bb04b0793717a5d0659e3fbcf8003708ee5ccb542" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-to-r2.patch", + "sha256": "sha256:63f35421b67576188ff92d920319a23aa0a6606b9a2137d1061687c77126b541" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r2-initial-readonly-dry-run.json", + "sha256": "sha256:631c6f0d8c0f66f51509751094937fd909821d4f45a042fd77f9d10f237115b8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-headroom-refusal.json", + "sha256": "sha256:89c847b4a75f138ff2464fc8291cf36939d293a777fd41ffd41d72f96ba9a2f8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-local-source-refusal.json", + "sha256": "sha256:fdd3b584da6ebedc173ccc5f8879c42dbd821d4b98338337fbef809a403485ba" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/runtime.py", + "sha256": "sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-addendum.json", + "sha256": "sha256:9588f51b353093d178b8c52892ca627c2317fab761591715a0765603a4182a8f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-observation.json", + "sha256": "sha256:ba4012303e5634686208a818b221113a1a670c31ed29269d8a4cc98308616275" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/test_process_supervision.py", + "sha256": "sha256:7ea89d9dee17d6ac4b554e25c083ac43d9b94039a4bcbe411d0e2ccbfb55a180" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/transfer-archive.json", + "sha256": "sha256:3222ccd39ea968353ea5e58ec36f0e3ca35b608020444243b053074a36abfe0b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md", + "sha256": "sha256:7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/action-inputs.json", + "sha256": "sha256:f37f6263e364e0caf4903a7374203224146f9655e9fec63e04c70b96b4351dbb" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/artifact-manifest.json", + "sha256": "sha256:19d3a74b124a9a7236bd4b8f6fe45656b4651d875017486f0dfa515f3f81d806" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/cleanup-upload-staging.py", + "sha256": "sha256:d007c297d80cffad2b42040d92f8335c6bae8aa13021098256222dea0c76f3d3" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execute-verify.py", + "sha256": "sha256:252cf6dfb5c501bc82259f0370b2912f73b1edfeb60b2d7af9036d4b82588ed5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/final-readonly-dry-run.json", + "sha256": "sha256:d7d273b2df07e919d0a1b35b765d9e6722f9cb215ce91d8553e79326384c5a7d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/frozen-native-argv.json", + "sha256": "sha256:0efb13aa725111cc227453bc7fc40eaf039c83cbd291ca7cb0409daf6b1e6c55" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/local-fixture-results.json", + "sha256": "sha256:339b2fcfd8d407e09874592b681830c605a463a88841351eed494a182d677219" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/process_supervision.py", + "sha256": "sha256:ec08fe309b36e55a0013e73d35b4db3a8eed9cdf32412a923cbafa83f68788c4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-baseline.json", + "sha256": "sha256:caaea4ca1b6bfa7fd765a3f4e5fe556d9484b77eac388af6ff20735d6962f81d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-to-r3-supervisor.patch", + "sha256": "sha256:00f5540bed786b912d8c3ce8aaa3fc012b4cf3eb208edbbe0d15139dcc533c09" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-zombie-counterexample.json", + "sha256": "sha256:c4a81c396e02e3bf372d6cd31f69c8030574576c171c8b455e8ca641106a1f83" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/reproduce-r2.py", + "sha256": "sha256:dce2d3cd5fa2c55a9ad84cbdd5f133d71ea483ada4ba88cc76997640e928de60" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/retained-fixture-refinement.json", + "sha256": "sha256:2d171d188345637a4e862a76ab917a39854c94058338d7c31c8c8ce397d8da51" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/runtime.py", + "sha256": "sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/source-contract-pins.json", + "sha256": "sha256:900475059e62063ea899ef42bc3de9c9edf794c7113b3f4a46491a3984090b6b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/test_process_supervision.py", + "sha256": "sha256:93a6c98ccf971ea18bd5e9efffcc7c5a6b0456540cae9856d1addf5e38a88239" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/test_receipt_cleanup.py", + "sha256": "sha256:1c64e3e68cb42a539e5b63c4137f56ff3d6924840ba4eb9cbfd8bb329f0d0616" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/verify-installed.py", + "sha256": "sha256:846369568edf016e5122e30fdd861f855e77c14713b644ddd175d1181afe6b93" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/FINAL-PROPOSAL.md", + "sha256": "sha256:408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/approval-decision.json", + "sha256": "sha256:ac6d9534d90e8af99af250f716b953b43ca9108f9a06df9567a727ccb6e74be4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/installed-partial-verification.json", + "sha256": "sha256:8da5a42a68a6f21b92a925fe36fe233ac153c2762846a29d0710e368b05f6fff" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/root-review.json", + "sha256": "sha256:bc8016d73bc435a184dbfce881a37bb63b82075a20d3e0c59c6701a2e6bfb35e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/pending-decision.json", + "sha256": "sha256:e0d053b431813a548c94bde0e18f92cd7edffe3764255cb8ba929e6c5113b5ba" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/checkpoint-progress.json", + "sha256": "sha256:b62c553375b4ffd5670297db341c776be8a22b750fbcc77b06a486941c8e2843" + }, + { + "path": ".kaizen/agents/custodian-codex/supervision.json", + "sha256": "sha256:75999d1df7914a23006443c8d1066c1a8fc3657e11d727b7f3ea242ac4431da3" + }, + { + "path": "docs/netkingdom-target-implementation.md", + "sha256": "sha256:a5ee625a4b31793dd0834265b61e91b613df735aeb1f2b8359376acf5ff91a78" + }, + { + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md", + "sha256": "sha256:4d43daf26f823ed205041093d6262c24e2f53483ef26626fc49239b5a460191f" + } + ] + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/source-head-drift-refusal.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/source-head-drift-refusal.json new file mode 100644 index 00000000..25ee1540 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/source-head-drift-refusal.json @@ -0,0 +1,8 @@ +{ + "status": "preparation_refused_before_mutation", + "expected_head": "6f61224f12f0be060d2686f0466c80d7274f77cb", + "actual_head": "4097a0bfbc42b937f23a06d19d3aa4587c51927f", + "remote_head": "4c04e40c2629509bac34e507eb0169387533bb6c", + "reason": "Concurrent independent source commits appeared since prior checkpoint; no publication plan/commit/push/sync was executed. Preserve other work and reconcile current head before publication.", + "native_effect": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unexecuted-key39-record-refinement.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unexecuted-key39-record-refinement.json new file mode 100644 index 00000000..d226a01a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unexecuted-key39-record-refinement.json @@ -0,0 +1,9 @@ +{ + "reason": "New user steering asks KEY39/infrastructure finalization review; add completed assessment to unexecuted final source batch only. Frozen runtime proposals/helpers unchanged.", + "changed_paths": [ + "docs/netkingdom-target-implementation.md", + "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + ], + "added_public_assessment_files": 4, + "previous_plan_sha256": "sha256:2641f9da9b8ee0a1cdc40c732edc6be58de866267771c2f588382cc486ecb693" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unexecuted-outcome-record-refinement.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unexecuted-outcome-record-refinement.json new file mode 100644 index 00000000..0c3e3a06 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unexecuted-outcome-record-refinement.json @@ -0,0 +1,11 @@ +{ + "reason": "Actual founder R3 approval and CPU-only read-only preflight refusal arrived after batch0; update only unexecuted outcome records, not frozen R2/R3 proposals/helpers.", + "changed_paths": [ + ".kaizen/agents/custodian-codex/supervision.json", + "docs/netkingdom-target-implementation.md", + "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + ], + "added_public_receipts": 2, + "original_plan_sha256": "sha256:64b54188b4910c502be0d5539ae9328f83263bb9e7d2fbff5f742e8bb7aca53c", + "batch0_bytes_unchanged": true +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unrelated-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unrelated-backup/.custodian-brief.md.worktree new file mode 100644 index 00000000..6aad3a57 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unrelated-backup/.custodian-brief.md.worktree @@ -0,0 +1,62 @@ + +# Custodian Brief — the-custodian + +**Domain:** infotech +**Last synced:** 2026-10-15 23:45 UTC +**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + +## Active Workstreams + +### NetKingdom target security architecture and SEC-DSM implementation +Progress: 2/6 done | workplan_id: `dfadb19b-445e-59c6-bcd6-48e87b912c52` + +**Open tasks:** +- ► Close source defects and reconcile uncovered lifecycle gaps `87637402` +- ► Coordinate self-service Playwright identity delivery `ed8b909a` +- ► Establish the target architecture and drive the restructuring `6aca534c` +- · Verify native closure against every requirement `82378b0f` + +### Separate agent credentials and establish supervised privileged execution +Progress: 2/5 done | workplan_id: `a98a9f34-83b4-5c8c-8107-e05f7806d50d` + +**Open tasks:** +- ! Build and hand out the agent identity `4b88b0b7` + *(wait: Await GLAS-WP-0012 (glas-harness) production acceptance of the local supervised profile; then railiance-platform RBAC, railiance-enablement k3s config, railiance-infra principal mapping and ops-warden certificate issuance.)* +- ! Fleet guidance and harness guards `90725511` + *(wait: Await CUST-WP-0073-T02: the verified agent identity and execution path must exist before it can be documented; Codex/Grok read-denial guard needs glas-harness or harness-owner delivery.)* +- ! Rotate what was exposed `1b41b532` + *(wait: Deferred by founder decision 2026-09-24; reopened only by the founder on one of the three triggers below, in one attended rotation window.)* + +### Size Railiance workloads from actual demand and establish a weekly allocation review +Progress: 1/5 done | workplan_id: `2249bddb-7524-5add-bd5c-c4163a6ca0f3` + +**Open tasks:** +- ! Measure the Vergabe prototype under representative pilot use `82192370` + *(wait: Await RAPPS-WP-0014-T03 (blocked, needs_human): populated two-user/document workflow run by Bernd and the company contact, giving representative load for p95 <= 2s / zero failures.)* +- ! Review ecosystem allocations and reserve operating room `6dc67558` + *(wait: Await CUST-WP-0071-T02 representative sample; Forgejo/runner demand and zero-request workload review need owner input (railiance-cluster, railiance-forge, resource-control).)* +- ! Apply accepted sizing changes and verify their effects `944f98e2` + *(wait: Await reviewed allocation proposals and applicable workload-owner authority.)* +- ! Establish the regular weekly workload-demand and allocation assessment `20ddd4d7` + *(wait: Await the repeatable observation and accepted sizing/review procedure.)* + +### Deterministic security flow: standing authorizations, flow report, and agent re-engagement +Progress: 3/7 done | workplan_id: `ab288f92-d364-5c24-9362-aee451f266c3` + +**Open tasks:** +- ! Schedule the flow report and decision sync `1be0569c` + *(wait: Activity Core accepted the schedule in ACTIVITY-WP-0047. Await claiming rein workstation/hub acceptance, owner activation and the first unassisted fire with report/checkpoint evidence.)* +- ! Encode the standing change rule as a policy-nexus guardrail `5dd52156` + *(wait: policy-nexus owns guardrail publication; handoff written as PNEX-WP-0006.)* +- ! Stop agent-authored index and sync commits `8a3dc219` + *(wait: Local guard and repeatable shared-hook installation are implemented. Fleet generator adoption and the required full week of clean history remain unverified; repo-manager owner acceptance is needed.)* +- ! Attended window #1 `e3da807f` + *(wait: Partly done 2026-10-11: list cut from 14 to 3; U05-U07 accepted, U08 waits on KEY-WP-0040-T01. Remaining founder acts: USER-WP-0026-T03 readback, RPF-WP-0044-T08 coulombcore check, the U08 re-run, and Sol's added RPF-WP-0044-T04 issuer login.)* + +--- +## MCP Orientation (when available) + +If the state-hub MCP server is reachable, call: +`get_domain_summary("infotech")` +This provides richer cross-domain context. +If the MCP call fails, use this file as your orientation source. diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unrelated-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unrelated-backup/WORK-RECORDS.md.worktree new file mode 100644 index 00000000..6dc81634 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unrelated-backup/WORK-RECORDS.md.worktree @@ -0,0 +1,536 @@ +# Work Records — the-custodian + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | CUST-WP-ADHOC-2026-05-02 | done | — | workplans/ADHOC-2026-05-02.md | +| workplan | CUST-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md | +| workplan | CUST-WP-ADHOC-2026-08-25-RETIRED | finished | — | workplans/ADHOC-2026-08-25-retired.md | +| workplan | CUST-WP-ADHOC-2026-08-25 | finished | — | workplans/ADHOC-2026-08-25.md | +| workplan | CUST-WP-ADHOC-2026-09-06 | finished | — | workplans/ADHOC-2026-09-06.md | +| workplan | CUST-WP-0000 | finished | — | workplans/CUST-WP-0000-state-hub-v0.1-build-deploy.md | +| workplan | CUST-WP-0000b | finished | — | workplans/CUST-WP-0000b-state-hub-v0.2-decisions-dependencies.md | +| workplan | CUST-WP-0001 | done | — | workplans/CUST-WP-0001-custodian-agent-runtime.md | +| workplan | CUST-WP-0002 | finished | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| workplan | CUST-WP-0004 | finished | — | workplans/CUST-WP-0004-ep-td-tracking.md | +| workplan | CUST-WP-0005 | finished | — | workplans/CUST-WP-0005-dynamic-domains.md | +| workplan | CUST-WP-0006 | done | — | workplans/CUST-WP-0006-gems-state-hub.md | +| workplan | CUST-WP-0007 | finished | — | workplans/CUST-WP-0007-gems-migration.md | +| workplan | CUST-WP-0008 | done | — | workplans/CUST-WP-0008-consistency-engine.md | +| workplan | CUST-WP-0009 | finished | — | workplans/CUST-WP-0009-human-interventions.md | +| workplan | CUST-WP-0010 | finished | — | workplans/CUST-WP-0010-workstream-lifecycle-docs.md | +| workplan | CUST-WP-0010b | finished | — | workplans/CUST-WP-0010b-domain-and-repo-goals.md | +| workplan | CUST-WP-0013 | finished | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| workplan | CUST-WP-0015 | done | — | workplans/CUST-WP-0015-agent-inbox.md | +| workplan | CUST-WP-0016 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md | +| workplan | CUST-WP-0017 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md | +| workplan | CUST-WP-0018 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md | +| workplan | CUST-WP-0019 | done | — | workplans/CUST-WP-0019-dashboard-ux-polish.md | +| workplan | CUST-WP-0020 | done | — | workplans/CUST-WP-0020-test-suite.md | +| workplan | CUST-WP-0021 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md | +| workplan | CUST-WP-0022 | done | — | workplans/CUST-WP-0022-capability-requests.md | +| workplan | CUST-WP-0023 | done | — | workplans/CUST-WP-0023-tpsc.md | +| workplan | CUST-WP-0024 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md | +| workplan | CUST-WP-0026 | done | — | workplans/CUST-WP-0026-distributed-consistency.md | +| workplan | CUST-WP-0027 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md | +| workplan | CUST-WP-0029 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md | +| workplan | CUST-WP-0030 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md | +| workplan | CUST-WP-0031 | done | — | workplans/CUST-WP-0031-capability-registry.md | +| workplan | CUST-WP-0032 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| workplan | CUST-WP-0033 | done | — | workplans/CUST-WP-0033-interface-change-registry.md | +| workplan | CUST-WP-0039 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md | +| workplan | CUST-WP-0040 | finished | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md | +| workplan | CUST-WP-0041 | done | — | workplans/CUST-WP-0041-api-performance.md | +| workplan | CUST-WP-0043 | finished | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md | +| workplan | CUST-WP-0044 | finished | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md | +| workplan | CUST-WP-0045 | finished | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md | +| workplan | CUST-WP-0069 | finished | — | workplans/CUST-WP-0045-cutover-runbook.md | +| workplan | CUST-WP-0046 | finished | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md | +| workplan | CUST-WP-0047 | finished | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md | +| workplan | CUST-WP-0048 | finished | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md | +| workplan | CUST-WP-0049 | finished | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md | +| workplan | CUST-WP-0050 | finished | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md | +| workplan | CUST-WP-0051 | finished | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md | +| workplan | CUST-WP-0052 | finished | — | workplans/CUST-WP-0052-core-hub-fos-reset.md | +| workplan | CUST-WP-0053 | finished | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md | +| workplan | CUST-WP-0055 | finished | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md | +| workplan | CUST-WP-0056 | finished | — | workplans/CUST-WP-0056-daily-todo-md-stale-review.md | +| workplan | CUST-WP-0059 | finished | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md | +| workplan | CUST-WP-0060 | finished | — | workplans/CUST-WP-0060-work-record-canonization.md | +| workplan | CUST-WP-0061 | finished | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md | +| workplan | CUST-WP-0062 | finished | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md | +| workplan | CUST-WP-0063 | finished | — | workplans/CUST-WP-0063-inbox-governance-packets.md | +| workplan | CUST-WP-0064 | finished | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | +| workplan | CUST-WP-0065 | finished | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md | +| workplan | CUST-WP-0066 | finished | — | workplans/CUST-WP-0066-repository-qualified-ad-hoc-identifiers.md | +| workplan | CUST-WP-0067 | finished | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md | +| workplan | CUST-WP-0068 | finished | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md | +| workplan | CUST-WP-0070 | finished | — | workplans/CUST-WP-0070-publication-repo-category.md | +| workplan | CUST-WP-0071 | blocked | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md | +| workplan | CUST-WP-0072 | finished | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md | +| workplan | CUST-WP-0073 | blocked | — | workplans/CUST-WP-0073-agent-credential-separation.md | +| workplan | CUST-WP-0074 | finished | — | workplans/CUST-WP-0074-qualified-wait-states.md | +| workplan | CUST-WP-0075 | finished | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md | +| workplan | CUST-WP-0076 | finished | — | workplans/CUST-WP-0076-provisioning-window-cadence.md | +| workplan | CUST-WP-0077 | finished | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md | +| workplan | CUST-WP-0078 | finished | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md | +| workplan | CUST-WP-0079 | blocked | — | workplans/CUST-WP-0079-deterministic-security-flow.md | +| workplan | CUST-WP-0080 | active | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md | +| workplan | CUST-WP-0081 | finished | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md | +| workplan | THE-WP-0001 | finished | — | workplans/THE-WP-0001-federation-interface.md | +| task | CUST-WP-ADHOC-2026-05-02-T01 | done | — | workplans/ADHOC-2026-05-02.md | +| task | CUST-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | +| task | ADHOC-2026-08-25-T01 | done | — | workplans/ADHOC-2026-08-25-retired.md | +| task | CUST-WP-ADHOC-2026-08-25-T01 | done | — | workplans/ADHOC-2026-08-25.md | +| task | CUST-WP-ADHOC-2026-09-06-T01 | done | — | workplans/ADHOC-2026-09-06.md | +| task | CUST-WP-0001-T01 | done | — | workplans/CUST-WP-0001-custodian-agent-runtime.md | +| task | CUST-WP-0001-T02 | done | — | workplans/CUST-WP-0001-custodian-agent-runtime.md | +| task | CUST-WP-0002-T01 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T02 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T03 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T04 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T05 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T06 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T07 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T08 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T09 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T10 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T11 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T12 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T13 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T14 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0002-T15 | done | — | workplans/CUST-WP-0002-contribution-tracking-sbom.md | +| task | CUST-WP-0004-T01 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md | +| task | CUST-WP-0004-T02 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md | +| task | CUST-WP-0004-T03 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md | +| task | CUST-WP-0004-T04 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md | +| task | CUST-WP-0004-T05 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md | +| task | CUST-WP-0004-T06 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md | +| task | CUST-WP-0004-T07 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md | +| task | CUST-WP-0004-T08 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md | +| task | CUST-WP-0004-T09 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md | +| task | CUST-WP-0004-T10 | done | — | workplans/CUST-WP-0004-ep-td-tracking.md | +| task | CUST-WP-0005-T01 | done | — | workplans/CUST-WP-0005-dynamic-domains.md | +| task | CUST-WP-0005-T02 | done | — | workplans/CUST-WP-0005-dynamic-domains.md | +| task | CUST-WP-0005-T03 | done | — | workplans/CUST-WP-0005-dynamic-domains.md | +| task | CUST-WP-0005-T04 | done | — | workplans/CUST-WP-0005-dynamic-domains.md | +| task | CUST-WP-0005-T05 | done | — | workplans/CUST-WP-0005-dynamic-domains.md | +| task | CUST-WP-0005-T06 | done | — | workplans/CUST-WP-0005-dynamic-domains.md | +| task | CUST-WP-0005-T07 | done | — | workplans/CUST-WP-0005-dynamic-domains.md | +| task | CUST-WP-0005-T08 | done | — | workplans/CUST-WP-0005-dynamic-domains.md | +| task | CUST-WP-0005-T09 | done | — | workplans/CUST-WP-0005-dynamic-domains.md | +| task | CUST-WP-0005-T10 | done | — | workplans/CUST-WP-0005-dynamic-domains.md | +| task | CUST-WP-0005-T11 | done | — | workplans/CUST-WP-0005-dynamic-domains.md | +| task | T01 | done | — | workplans/CUST-WP-0006-gems-state-hub.md | +| task | T02 | done | — | workplans/CUST-WP-0006-gems-state-hub.md | +| task | T03 | done | — | workplans/CUST-WP-0006-gems-state-hub.md | +| task | T04 | done | — | workplans/CUST-WP-0006-gems-state-hub.md | +| task | T05 | done | — | workplans/CUST-WP-0006-gems-state-hub.md | +| task | T01 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T02 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T03 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T04 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T05 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T06 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T07 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T08 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T09 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T10 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T11 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T12 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T13 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T14 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T15 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T16 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | T17 | done | — | workplans/CUST-WP-0007-gems-migration.md | +| task | CUST-WP-0008-T01 | done | — | workplans/CUST-WP-0008-consistency-engine.md | +| task | CUST-WP-0008-T02 | done | — | workplans/CUST-WP-0008-consistency-engine.md | +| task | CUST-WP-0008-T03 | done | — | workplans/CUST-WP-0008-consistency-engine.md | +| task | CUST-WP-0008-T04 | done | — | workplans/CUST-WP-0008-consistency-engine.md | +| task | CUST-WP-0009-T1 | done | — | workplans/CUST-WP-0009-human-interventions.md | +| task | CUST-WP-0009-T2 | done | — | workplans/CUST-WP-0009-human-interventions.md | +| task | CUST-WP-0009-T3 | done | — | workplans/CUST-WP-0009-human-interventions.md | +| task | CUST-WP-0010-T1 | done | — | workplans/CUST-WP-0010-workstream-lifecycle-docs.md | +| task | CUST-WP-0010-T2 | done | — | workplans/CUST-WP-0010-workstream-lifecycle-docs.md | +| task | CUST-WP-0010-T3 | done | — | workplans/CUST-WP-0010-workstream-lifecycle-docs.md | +| task | CUST-WP-0010b-T01 | done | — | workplans/CUST-WP-0010b-domain-and-repo-goals.md | +| task | CUST-WP-0010b-T02 | done | — | workplans/CUST-WP-0010b-domain-and-repo-goals.md | +| task | CUST-WP-0013-T01 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T02 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T03 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T04 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T05 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T06 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T07 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T08 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T09 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T10 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T11 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T12 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T13 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0013-T14 | done | — | workplans/CUST-WP-0013-sbom-infra-expansion.md | +| task | CUST-WP-0015-T01 | done | — | workplans/CUST-WP-0015-agent-inbox.md | +| task | CUST-WP-0015-T02 | done | — | workplans/CUST-WP-0015-agent-inbox.md | +| task | CUST-WP-0015-T03 | done | — | workplans/CUST-WP-0015-agent-inbox.md | +| task | CUST-WP-0015-T04 | done | — | workplans/CUST-WP-0015-agent-inbox.md | +| task | CUST-WP-0015-T05 | done | — | workplans/CUST-WP-0015-agent-inbox.md | +| task | CUST-WP-0016-T01 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md | +| task | CUST-WP-0016-T02 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md | +| task | CUST-WP-0016-T03 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md | +| task | CUST-WP-0016-T04 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md | +| task | CUST-WP-0016-T05 | done | — | workplans/CUST-WP-0016-kaizen-agentic-integration.md | +| task | CUST-WP-0017-T01 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md | +| task | CUST-WP-0017-T02 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md | +| task | CUST-WP-0017-T03 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md | +| task | CUST-WP-0017-T04 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md | +| task | CUST-WP-0017-T05 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md | +| task | CUST-WP-0017-T06 | done | — | workplans/CUST-WP-0017-scope-md-agent-and-coverage.md | +| task | CUST-WP-0018-T01 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md | +| task | CUST-WP-0018-T02 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md | +| task | CUST-WP-0018-T03 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md | +| task | CUST-WP-0018-T04 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md | +| task | CUST-WP-0018-T05 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md | +| task | CUST-WP-0018-T06 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md | +| task | CUST-WP-0018-T07 | done | — | workplans/CUST-WP-0018-api-hardening-code-quality.md | +| task | CUST-WP-0019-T01 | done | — | workplans/CUST-WP-0019-dashboard-ux-polish.md | +| task | CUST-WP-0019-T02 | done | — | workplans/CUST-WP-0019-dashboard-ux-polish.md | +| task | CUST-WP-0019-T03 | done | — | workplans/CUST-WP-0019-dashboard-ux-polish.md | +| task | CUST-WP-0020-T01 | done | — | workplans/CUST-WP-0020-test-suite.md | +| task | CUST-WP-0020-T02 | done | — | workplans/CUST-WP-0020-test-suite.md | +| task | CUST-WP-0020-T03 | done | — | workplans/CUST-WP-0020-test-suite.md | +| task | CUST-WP-0020-T04 | done | — | workplans/CUST-WP-0020-test-suite.md | +| task | CUST-WP-0020-T05 | done | — | workplans/CUST-WP-0020-test-suite.md | +| task | CUST-WP-0021-T01 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md | +| task | CUST-WP-0021-T02 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md | +| task | CUST-WP-0021-T03 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md | +| task | CUST-WP-0021-T04 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md | +| task | CUST-WP-0021-T05 | done | — | workplans/CUST-WP-0021-multi-host-repo-paths.md | +| task | CUST-WP-0022-T01 | done | — | workplans/CUST-WP-0022-capability-requests.md | +| task | CUST-WP-0022-T02 | done | — | workplans/CUST-WP-0022-capability-requests.md | +| task | CUST-WP-0022-T03 | done | — | workplans/CUST-WP-0022-capability-requests.md | +| task | CUST-WP-0022-T04 | done | — | workplans/CUST-WP-0022-capability-requests.md | +| task | CUST-WP-0022-T05 | done | — | workplans/CUST-WP-0022-capability-requests.md | +| task | CUST-WP-0022-T06 | done | — | workplans/CUST-WP-0022-capability-requests.md | +| task | CUST-WP-0022-T07 | done | — | workplans/CUST-WP-0022-capability-requests.md | +| task | CUST-WP-0022-T08 | done | — | workplans/CUST-WP-0022-capability-requests.md | +| task | CUST-WP-0022-T09 | done | — | workplans/CUST-WP-0022-capability-requests.md | +| task | CUST-WP-0022-T10 | done | — | workplans/CUST-WP-0022-capability-requests.md | +| task | CUST-WP-0023-T01 | done | — | workplans/CUST-WP-0023-tpsc.md | +| task | CUST-WP-0023-T02 | done | — | workplans/CUST-WP-0023-tpsc.md | +| task | CUST-WP-0023-T03 | done | — | workplans/CUST-WP-0023-tpsc.md | +| task | CUST-WP-0023-T04 | done | — | workplans/CUST-WP-0023-tpsc.md | +| task | CUST-WP-0023-T05 | done | — | workplans/CUST-WP-0023-tpsc.md | +| task | CUST-WP-0023-T06 | done | — | workplans/CUST-WP-0023-tpsc.md | +| task | CUST-WP-0023-T07 | done | — | workplans/CUST-WP-0023-tpsc.md | +| task | CUST-WP-0023-T08 | done | — | workplans/CUST-WP-0023-tpsc.md | +| task | CUST-WP-0023-T09 | done | — | workplans/CUST-WP-0023-tpsc.md | +| task | CUST-WP-0023-T10 | done | — | workplans/CUST-WP-0023-tpsc.md | +| task | CUST-WP-0024-T01 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md | +| task | CUST-WP-0024-T02 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md | +| task | CUST-WP-0024-T03 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md | +| task | CUST-WP-0024-T04 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md | +| task | CUST-WP-0024-T05 | done | — | workplans/CUST-WP-0024-repo-doi-gate.md | +| task | CUST-WP-0026-T01 | done | — | workplans/CUST-WP-0026-distributed-consistency.md | +| task | CUST-WP-0026-T02 | done | — | workplans/CUST-WP-0026-distributed-consistency.md | +| task | CUST-WP-0026-T03 | done | — | workplans/CUST-WP-0026-distributed-consistency.md | +| task | CUST-WP-0026-T04 | done | — | workplans/CUST-WP-0026-distributed-consistency.md | +| task | CUST-WP-0026-T05 | done | — | workplans/CUST-WP-0026-distributed-consistency.md | +| task | CUST-WP-0027-T01 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md | +| task | CUST-WP-0027-T02 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md | +| task | CUST-WP-0027-T03 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md | +| task | CUST-WP-0027-T04 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md | +| task | CUST-WP-0027-T05 | done | — | workplans/CUST-WP-0027-capability-request-dispute.md | +| task | CUST-WP-0029-T01 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md | +| task | CUST-WP-0029-T02 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md | +| task | CUST-WP-0029-T03 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md | +| task | CUST-WP-0029-T04 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md | +| task | CUST-WP-0029-T05 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md | +| task | CUST-WP-0029-T06 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md | +| task | CUST-WP-0029-T07 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md | +| task | CUST-WP-0029-T08 | done | — | workplans/CUST-WP-0029-token-consumption-tracking.md | +| task | T01 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md | +| task | T02 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md | +| task | T03 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md | +| task | T04 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md | +| task | T05 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md | +| task | T06 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md | +| task | T07 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md | +| task | T08 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md | +| task | T09 | done | — | workplans/CUST-WP-0030-dashboard-entity-list-ux.md | +| task | T01 | done | — | workplans/CUST-WP-0031-capability-registry.md | +| task | T02 | done | — | workplans/CUST-WP-0031-capability-registry.md | +| task | T03 | done | — | workplans/CUST-WP-0031-capability-registry.md | +| task | T04 | done | — | workplans/CUST-WP-0031-capability-registry.md | +| task | T05 | done | — | workplans/CUST-WP-0031-capability-registry.md | +| task | T06 | done | — | workplans/CUST-WP-0031-capability-registry.md | +| task | T07 | done | — | workplans/CUST-WP-0031-capability-registry.md | +| task | CUST-WP-0032-T01 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T02 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T03 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T04 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T05 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T06 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T07 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T08 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T09 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T10 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T11 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T12 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T13 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T14 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0032-T15 | done | — | workplans/CUST-WP-0032-haskell-build-machine.md | +| task | CUST-WP-0033-T01 | done | — | workplans/CUST-WP-0033-interface-change-registry.md | +| task | CUST-WP-0033-T02 | done | — | workplans/CUST-WP-0033-interface-change-registry.md | +| task | CUST-WP-0033-T03 | done | — | workplans/CUST-WP-0033-interface-change-registry.md | +| task | CUST-WP-0033-T04 | done | — | workplans/CUST-WP-0033-interface-change-registry.md | +| task | CUST-WP-0033-T05 | done | — | workplans/CUST-WP-0033-interface-change-registry.md | +| task | CUST-WP-0033-T06 | done | — | workplans/CUST-WP-0033-interface-change-registry.md | +| task | CUST-WP-0039-T1 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md | +| task | CUST-WP-0039-T2 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md | +| task | CUST-WP-0039-T3 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md | +| task | CUST-WP-0039-T4 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md | +| task | CUST-WP-0039-T5 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md | +| task | CUST-WP-0039-T6 | done | — | workplans/CUST-WP-0039-dashboard-poll-optimization.md | +| task | T01 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md | +| task | T02 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md | +| task | T03 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md | +| task | T04 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md | +| task | T05 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md | +| task | T06 | done | — | workplans/CUST-WP-0040-state-hub-nats-activity-core-integration.md | +| task | CUST-WP-0041-T1 | done | — | workplans/CUST-WP-0041-api-performance.md | +| task | CUST-WP-0041-T2 | done | — | workplans/CUST-WP-0041-api-performance.md | +| task | CUST-WP-0041-T3 | done | — | workplans/CUST-WP-0041-api-performance.md | +| task | CUST-WP-0041-T4 | done | — | workplans/CUST-WP-0041-api-performance.md | +| task | CUST-WP-0043-T01 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md | +| task | CUST-WP-0043-T02 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md | +| task | CUST-WP-0043-T03 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md | +| task | CUST-WP-0043-T04 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md | +| task | CUST-WP-0043-T05 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md | +| task | CUST-WP-0043-T06 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md | +| task | CUST-WP-0043-T07 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md | +| task | CUST-WP-0043-T08 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md | +| task | CUST-WP-0043-T09 | done | — | workplans/CUST-WP-0043-state-hub-repo-extraction.md | +| task | CUST-WP-0044-T01 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md | +| task | CUST-WP-0044-T02 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md | +| task | CUST-WP-0044-T03 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md | +| task | CUST-WP-0044-T04 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md | +| task | CUST-WP-0044-T05 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md | +| task | CUST-WP-0044-T06 | done | — | workplans/CUST-WP-0044-daily-statehub-wsjf-triage.md | +| task | CUST-WP-0045-T01 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md | +| task | CUST-WP-0045-T02 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md | +| task | CUST-WP-0045-T03 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md | +| task | CUST-WP-0045-T04 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md | +| task | CUST-WP-0045-T05 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md | +| task | CUST-WP-0045-T06 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md | +| task | CUST-WP-0045-T07 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md | +| task | CUST-WP-0045-T08 | done | — | workplans/CUST-WP-0045-activity-core-daily-triage-runner.md | +| task | CUST-WP-0046-T01 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md | +| task | CUST-WP-0046-T02 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md | +| task | CUST-WP-0046-T03 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md | +| task | CUST-WP-0046-T04 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md | +| task | CUST-WP-0046-T05 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md | +| task | CUST-WP-0046-T06 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md | +| task | CUST-WP-0046-T07 | done | — | workplans/CUST-WP-0046-hourly-recently-on-scope-activity-core.md | +| task | CUST-WP-0047-T01 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md | +| task | CUST-WP-0047-T02 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md | +| task | CUST-WP-0047-T03 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md | +| task | CUST-WP-0047-T04 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md | +| task | CUST-WP-0047-T05 | cancel | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md | +| task | CUST-WP-0047-T06 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md | +| task | CUST-WP-0047-T07 | done | — | workplans/CUST-WP-0047-ops-hub-service-inventory-now-view.md | +| task | CUST-WP-0048-T01 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md | +| task | CUST-WP-0048-T02 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md | +| task | CUST-WP-0048-T03 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md | +| task | CUST-WP-0048-T04 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md | +| task | CUST-WP-0048-T05 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md | +| task | CUST-WP-0048-T06 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md | +| task | CUST-WP-0048-T07 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md | +| task | CUST-WP-0048-T08 | done | — | workplans/CUST-WP-0048-hub-core-state-hub-import-refactor.md | +| task | CUST-WP-0049-T01 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md | +| task | CUST-WP-0049-T02 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md | +| task | CUST-WP-0049-T03 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md | +| task | CUST-WP-0049-T04 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md | +| task | CUST-WP-0049-T05 | done | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md | +| task | CUST-WP-0049-T06 | cancel | — | workplans/CUST-WP-0049-interhub-bootstrap-access-lane.md | +| task | CUST-WP-0050-T01 | done | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md | +| task | CUST-WP-0050-T02 | done | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md | +| task | CUST-WP-0050-T03 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md | +| task | CUST-WP-0050-T04 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md | +| task | CUST-WP-0050-T05 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md | +| task | CUST-WP-0050-T06 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md | +| task | CUST-WP-0050-T07 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md | +| task | CUST-WP-0050-T08 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md | +| task | CUST-WP-0050-T09 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md | +| task | CUST-WP-0050-T10 | cancel | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md | +| task | CUST-WP-0050-T11 | done | — | workplans/CUST-WP-0050-repo-classification-registration-redesign.md | +| task | CUST-WP-0051-T01 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md | +| task | CUST-WP-0051-T02 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md | +| task | CUST-WP-0051-T03 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md | +| task | CUST-WP-0051-T04 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md | +| task | CUST-WP-0051-T05 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md | +| task | CUST-WP-0051-T06 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md | +| task | CUST-WP-0051-T07 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md | +| task | CUST-WP-0051-T08 | done | — | workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md | +| task | CUST-WP-0052-T01 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md | +| task | CUST-WP-0052-T02 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md | +| task | CUST-WP-0052-T03 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md | +| task | CUST-WP-0052-T04 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md | +| task | CUST-WP-0052-T05 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md | +| task | CUST-WP-0052-T06 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md | +| task | CUST-WP-0052-T07 | done | — | workplans/CUST-WP-0052-core-hub-fos-reset.md | +| task | CUST-WP-0053-T01 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md | +| task | CUST-WP-0053-T02 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md | +| task | CUST-WP-0053-T03 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md | +| task | CUST-WP-0053-T04 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md | +| task | CUST-WP-0053-T05 | done | — | workplans/CUST-WP-0053-coordination-hygiene-improvements.md | +| task | CUST-WP-0055-T01 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md | +| task | CUST-WP-0055-T02 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md | +| task | CUST-WP-0055-T03 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md | +| task | CUST-WP-0055-T04 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md | +| task | CUST-WP-0055-T05 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md | +| task | CUST-WP-0055-T06 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md | +| task | CUST-WP-0055-T07 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md | +| task | CUST-WP-0055-T08 | done | — | workplans/CUST-WP-0055-workplan-terminology-fleet-refactor.md | +| task | CUST-WP-0056-T01 | done | — | workplans/CUST-WP-0056-daily-todo-md-stale-review.md | +| task | CUST-WP-0056-T02 | done | — | workplans/CUST-WP-0056-daily-todo-md-stale-review.md | +| task | CUST-WP-0056-T03 | done | — | workplans/CUST-WP-0056-daily-todo-md-stale-review.md | +| task | CUST-WP-0059-T01 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md | +| task | CUST-WP-0059-T02 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md | +| task | CUST-WP-0059-T03 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md | +| task | CUST-WP-0059-T04 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md | +| task | CUST-WP-0059-T05 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md | +| task | CUST-WP-0059-T06 | done | — | workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md | +| task | CUST-WP-0060-T01 | done | — | workplans/CUST-WP-0060-work-record-canonization.md | +| task | CUST-WP-0060-T02 | done | — | workplans/CUST-WP-0060-work-record-canonization.md | +| task | CUST-WP-0060-T03 | done | — | workplans/CUST-WP-0060-work-record-canonization.md | +| task | CUST-WP-0060-T04 | done | — | workplans/CUST-WP-0060-work-record-canonization.md | +| task | CUST-WP-0060-T05 | done | — | workplans/CUST-WP-0060-work-record-canonization.md | +| task | CUST-WP-0060-T06 | done | — | workplans/CUST-WP-0060-work-record-canonization.md | +| task | CUST-WP-0060-T07 | done | — | workplans/CUST-WP-0060-work-record-canonization.md | +| task | CUST-WP-0061-T01 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md | +| task | CUST-WP-0061-T02 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md | +| task | CUST-WP-0061-T03 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md | +| task | CUST-WP-0061-T04 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md | +| task | CUST-WP-0061-T05 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md | +| task | CUST-WP-0061-T06 | done | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md | +| task | CUST-WP-0062-T01 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md | +| task | CUST-WP-0062-T02 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md | +| task | CUST-WP-0062-T03 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md | +| task | CUST-WP-0062-T04 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md | +| task | CUST-WP-0062-T05 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md | +| task | CUST-WP-0062-T06 | done | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md | +| task | CUST-WP-0063-T01 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md | +| task | CUST-WP-0063-T02 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md | +| task | CUST-WP-0063-T03 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md | +| task | CUST-WP-0063-T04 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md | +| task | CUST-WP-0063-T05 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md | +| task | CUST-WP-0064-T01 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | +| task | CUST-WP-0064-T02 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | +| task | CUST-WP-0064-T03 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | +| task | CUST-WP-0064-T04 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | +| task | CUST-WP-0065-T01 | done | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md | +| task | CUST-WP-0065-T02 | done | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md | +| task | CUST-WP-0065-T03 | done | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md | +| task | CUST-WP-0065-T04 | done | — | workplans/CUST-WP-0065-reclassify-repos-and-guidance-docs-to-the-new-sector-domain.md | +| task | CUST-WP-0066-T01 | done | — | workplans/CUST-WP-0066-repository-qualified-ad-hoc-identifiers.md | +| task | CUST-WP-0066-T02 | done | — | workplans/CUST-WP-0066-repository-qualified-ad-hoc-identifiers.md | +| task | CUST-WP-0066-T03 | done | — | workplans/CUST-WP-0066-repository-qualified-ad-hoc-identifiers.md | +| task | CUST-WP-0067-T01 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md | +| task | CUST-WP-0067-T02 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md | +| task | CUST-WP-0067-T03 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md | +| task | CUST-WP-0067-T04 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md | +| task | CUST-WP-0067-T05 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md | +| task | CUST-WP-0067-T06 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md | +| task | CUST-WP-0067-T07 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md | +| task | CUST-WP-0067-T08 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md | +| task | CUST-WP-0067-T09 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md | +| task | CUST-WP-0067-T10 | done | — | workplans/CUST-WP-0067-hub-authority-target-resolution.md | +| task | CUST-WP-0068-T01 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md | +| task | CUST-WP-0068-T02 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md | +| task | CUST-WP-0068-T03 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md | +| task | CUST-WP-0068-T04 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md | +| task | CUST-WP-0068-T05 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md | +| task | CUST-WP-0068-T06 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md | +| task | CUST-WP-0068-T07 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md | +| task | CUST-WP-0068-T08 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md | +| task | CUST-WP-0068-T09 | done | — | workplans/CUST-WP-0068-cache-only-work-record-recovery.md | +| task | CUST-WP-0070-T01 | done | — | workplans/CUST-WP-0070-publication-repo-category.md | +| task | CUST-WP-0070-T02 | done | — | workplans/CUST-WP-0070-publication-repo-category.md | +| task | CUST-WP-0070-T03 | done | — | workplans/CUST-WP-0070-publication-repo-category.md | +| task | CUST-WP-0071-T01 | done | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md | +| task | CUST-WP-0071-T02 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md | +| task | CUST-WP-0071-T03 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md | +| task | CUST-WP-0071-T04 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md | +| task | CUST-WP-0071-T05 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md | +| task | CUST-WP-0072-T01 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md | +| task | CUST-WP-0072-T02 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md | +| task | CUST-WP-0072-T03 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md | +| task | CUST-WP-0072-T04 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md | +| task | CUST-WP-0073-T01 | done | — | workplans/CUST-WP-0073-agent-credential-separation.md | +| task | CUST-WP-0073-T02 | wait | — | workplans/CUST-WP-0073-agent-credential-separation.md | +| task | CUST-WP-0073-T03 | done | — | workplans/CUST-WP-0073-agent-credential-separation.md | +| task | CUST-WP-0073-T04 | wait | — | workplans/CUST-WP-0073-agent-credential-separation.md | +| task | CUST-WP-0073-T05 | wait | — | workplans/CUST-WP-0073-agent-credential-separation.md | +| task | CUST-WP-0074-T01 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md | +| task | CUST-WP-0074-T02 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md | +| task | CUST-WP-0074-T03 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md | +| task | CUST-WP-0074-T04 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md | +| task | CUST-WP-0074-T05 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md | +| task | CUST-WP-0074-T06 | done | — | workplans/CUST-WP-0074-qualified-wait-states.md | +| task | CUST-WP-0075-T01 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md | +| task | CUST-WP-0075-T02 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md | +| task | CUST-WP-0075-T03 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md | +| task | CUST-WP-0075-T04 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md | +| task | CUST-WP-0075-T05 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md | +| task | CUST-WP-0075-T06 | done | — | workplans/CUST-WP-0075-dependency-graph-driven-unblocking.md | +| task | CUST-WP-0076-T01 | done | — | workplans/CUST-WP-0076-provisioning-window-cadence.md | +| task | CUST-WP-0077-T01 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md | +| task | CUST-WP-0077-T02 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md | +| task | CUST-WP-0077-T03 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md | +| task | CUST-WP-0077-T04 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md | +| task | CUST-WP-0077-T05 | done | — | workplans/CUST-WP-0077-dependency-root-execution-wave.md | +| task | CUST-WP-0078-T01 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md | +| task | CUST-WP-0078-T02 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md | +| task | CUST-WP-0078-T03 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md | +| task | CUST-WP-0078-T04 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md | +| task | CUST-WP-0079-T01 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md | +| task | CUST-WP-0079-T02 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md | +| task | CUST-WP-0079-T03 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md | +| task | CUST-WP-0079-T04 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md | +| task | CUST-WP-0079-T05 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md | +| task | CUST-WP-0079-T06 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md | +| task | CUST-WP-0079-T07 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md | +| task | CUST-WP-0080-T01 | done | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md | +| task | CUST-WP-0080-T02 | done | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md | +| task | CUST-WP-0080-T03 | progress | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md | +| task | CUST-WP-0080-T04 | todo | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md | +| task | CUST-WP-0080-T05 | progress | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md | +| task | CUST-WP-0080-T06 | progress | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md | +| task | CUST-WP-0081-T01 | done | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md | +| task | CUST-WP-0081-T02 | done | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md | +| task | CUST-WP-0081-T03 | done | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md | +| task | THE-WP-0001-T01 | done | — | workplans/THE-WP-0001-federation-interface.md | +| task | THE-WP-0001-T02 | done | — | workplans/THE-WP-0001-federation-interface.md | +| intake | CUST-IN-0001 | closed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0002 | closed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0003 | closed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0004 | routed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0005 | closed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0006 | closed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0007 | closed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0008 | closed | blue | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0009 | closed | blue | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0010 | closed | green | intake-legacy-suggestions-migration.md | +| intake | CUST-IN-0011 | routed | red | intakes.md | +| intake | CUST-IN-0012 | closed | green | intakes.md | +| intake | CUST-IN-0013 | closed | blue | intakes.md | +| intake | CUST-IN-0014 | closed | blue | intakes.md | +| intake | CUST-IN-0015 | open | blue | intakes.md | +| intake | CUST-IN-0016 | open | green | intakes.md | +| intake | CUST-IN-0017 | open | green | intakes.md | +| intake | CUST-IN-0018 | open | green | intakes.md | diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unrelated-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unrelated-backup/originals.json new file mode 100644 index 00000000..45e366f2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/unrelated-backup/originals.json @@ -0,0 +1,34 @@ +{ + ".custodian-brief.md": { + "sha256": "74e3f825b14c6fe5a0f8cf511e2b85d9010f56109ea5bee700b360766b3dd453", + "index": "100644 6aad3a5788fad3abd60c0f1270f160062dc0168b 0\t.custodian-brief.md\n" + }, + "WORK-RECORDS.md": { + "sha256": "b8dc1ac2245e7aa59b13af1f62b0ca21b6c5704cafdb5a4de7a81b2d5595265b", + "index": "100644 d535e0f2dcc3d454e041a8f1b547b5dea4493380 0\tWORK-RECORDS.md\n" + }, + "docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json": { + "sha256": "baecc157233131d17c73e84cd997db922d36ad235cbaa91f4938852220a824a2", + "index": "100644 bbe2969551797f8c0c7c33e1009f1b293a631113 0\tdocs/assessments/netkingdom-2026-10-14/hosted-before-federated.json\n" + }, + "docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json": { + "sha256": "92916fa2fcabbe3f4b7c4b89ddbd6dc6cb079ffd6f06cf66b2c6e6d6ff5fabde", + "index": "100644 af6b3430909c8cbf8190c53cd541da651291151a 0\tdocs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json\n" + }, + "docs/assessments/netkingdom-2026-10-14/owner-access-gate.json": { + "sha256": "059d36b607383c1458dd2909e9adc5ec8be42af7c41412b4ce2d244d20d093df", + "index": "100644 514edc14eb0a48736594bdd1bde2348e3d55e365 0\tdocs/assessments/netkingdom-2026-10-14/owner-access-gate.json\n" + }, + "docs/assessments/netkingdom-2026-10-14/publication-preflight.json": { + "sha256": "4b041890abae585ca78536fa12bb9668392f21b7c2c21f5f581e2eed516a1164", + "index": "100644 ee5730a4c683ee71240a4086e34a448cad92d88d 0\tdocs/assessments/netkingdom-2026-10-14/publication-preflight.json\n" + }, + "docs/assessments/netkingdom-2026-10-14/published-source-verification.json": { + "sha256": "f0095fc7a8089443f27ad50e358247705a6a5ce83c85f4d57b402b116741e7c0", + "index": "100644 83cdeb35d0ccd0b3a2472f8aa95767437566cbd9 0\tdocs/assessments/netkingdom-2026-10-14/published-source-verification.json\n" + }, + "docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json": { + "sha256": "29c43c9909bb8a94ebdc74312a545b66bcc73de1a355158bf247cf8fc405f16b", + "index": "100644 44097c5ea5ab08a0834ab1bd1d42fe4528bbb2c2 0\tdocs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json\n" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/netkingdom-commit.json b/docs/changes/netkingdom-target-2026-10-17/netkingdom-commit.json new file mode 100644 index 00000000..ea4b7d73 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/netkingdom-commit.json @@ -0,0 +1,46 @@ +{ + "exit_code": 0, + "stdout": "[main 70f408c] feat(identity): add PostgreSQL provenance and verify sealed SOPS custody\n 12 files changed, 811 insertions(+), 28 deletions(-)\n create mode 100644 identity-provisioner/group_provenance_postgres.py\n create mode 100644 identity-provisioner/migrations/group_journal_postgres_v1.sql\n create mode 100644 identity-provisioner/requirements-postgres.txt\n create mode 100644 identity-provisioner/tests/test_group_postgres.py\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 12, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n", + "head": "70f408ca2389bf3722a91a03832fc6e8587355e5", + "files": { + "docs/service-group-provenance.md": "b287e7a85aa2146f35d2bc8473dfd05239ea0179b7b8b186d2e85bc07c7b650c", + "identity-provisioner/Containerfile": "31e7d948d4f40efd6950764a3dbb8c410d50ed7a1c13c18e0830a1186f2abafc", + "identity-provisioner/group_provenance.py": "405e08eaaab7c21d618dff4db5970607806f32ab6c461effb81c737e32182b10", + "identity-provisioner/group_provenance_postgres.py": "2a0111e83ad7b611076a1b45634e7f698b3d2e9acc473320b4a8ba009ebd0932", + "identity-provisioner/migrations/group_journal_postgres_v1.sql": "3cdf82194d6f1e2dd865b0c7e7b8a14447fda8c49151148134a0d40a80fb46ac", + "identity-provisioner/provisioner.py": "19d1b837cbafeeacb1aa815856cd68091e6702281d72b1d860230fa320e1725b", + "identity-provisioner/requirements-postgres.txt": "14f1beae54a789d2c880654ca0ce4094c9aa54645e79314b4297c12938ba8877", + "identity-provisioner/tests/test_group_postgres.py": "ff3fd92587c8aeea66018718dd8a76f2504648fb3393b122e91ff35a6f431abc", + "tests/test_sops_private.py": "a5ff8d7847cdce151be44cdf4a89385d5e2585cdd59143dee4be3cc6106eb7f5", + "tests/test_sops_write.py": "f832925283e79589b3ce0bded7e50f49bfd4e78620c224549bb7d31a7868fca6", + "workplans/NK-WP-0048-security-case-types.md": "b737bfae4802c122b21619695a169d7d082672af96314b1709860dd5aff2a60f", + "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md": "678ec04b73b57c026001791706c05c5d4d5a508a32f17210ae8ad03ab15d53b8" + }, + "assignments": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "net-kingdom", + "namespace": "helixforge", + "assignments": [ + { + "kind": "task", + "record_id": "NK-WP-0048-T21", + "uuid": "afe78e4d-408a-516a-ab92-e212e8a2d11d", + "path": "workplans/NK-WP-0048-security-case-types.md" + }, + { + "kind": "task", + "record_id": "NK-WP-0049-T37", + "uuid": "3403e266-d63b-5ce1-b891-3bfeac93d28c", + "path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md" + } + ], + "historical_invalid_identifiers": [], + "files_changed": [ + "workplans/NK-WP-0048-security-case-types.md", + "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md" + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/netkingdom-consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/netkingdom-consistency.stderr.txt new file mode 100644 index 00000000..3345563f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/netkingdom-consistency.stderr.txt @@ -0,0 +1 @@ +WARN: git commit failed for writeback: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/netkingdom-identifiers-preview.json b/docs/changes/netkingdom-target-2026-10-17/netkingdom-identifiers-preview.json new file mode 100644 index 00000000..7b093221 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/netkingdom-identifiers-preview.json @@ -0,0 +1,19 @@ +{ + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": false, + "repo": "net-kingdom", + "namespace": "helixforge", + "assignments": [ + { + "kind": "task", + "record_id": "NK-WP-0049-T37", + "uuid": "3403e266-d63b-5ce1-b891-3bfeac93d28c", + "path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md" + } + ], + "historical_invalid_identifiers": [], + "files_changed": [ + "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/netkingdom-projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/netkingdom-projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/netkingdom-publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/netkingdom-publication-backup/.custodian-brief.md.worktree new file mode 100644 index 00000000..18bd5dff --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/netkingdom-publication-backup/.custodian-brief.md.worktree @@ -0,0 +1,85 @@ + +# Custodian Brief — net-kingdom + +**Domain:** infotech +**Last synced:** 2026-10-16 19:19 UTC +**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + +## Active Workstreams + +### Publish the NetKingdom emission-cadence security profile +Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc` + +**Open tasks:** +- ► Bind and hand off the published contract `e3fbc8b8` + +### Register Playwright human and agent consumers through governed identity delivery +Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377` + +**Open tasks:** +- ! Verify issuer and real consumer acceptance `5a3aaf57` + *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)* +- ► Deliver custody integration and guarded registration activation `a9dadd07` + +### Remove bootstrap secret output and verify separated recovery custody +Progress: 22/31 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804` + +**Open tasks:** +- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3` + *(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)* +- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00` + *(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)* +- ! Verify current caller and provider admission at their actual boundaries `77aa42be` + *(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)* +- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7` + *(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)* +- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773` + *(wait: LLDAP recovery T16 passed; await the exact isolated KeyCape adapter/procedure and retained-token MFA proof for the selected flow.)* +- ! Prove restored Authelia storage and OIDC continuity `b47f9975` + *(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)* +- ► Map current callers, owners and native acceptance gaps `479d6970` +- … and 2 more open tasks + +### Establish SecurityCaseTypes so that known security cases are light +Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb` + +**Open tasks:** +- ! T05 — Acknowledge the type through informed-decision `d9b26bcf` + *(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)* +- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae` + *(wait: The next types follow once the first one is proven end to end.)* + +### Define an execution-attribution receipt for Railiance runs +Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487` + +**Open tasks:** +- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1` + *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)* + +### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker +Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07` + +**Open tasks:** +- ! Admit the database consumer `2fe6f100` + *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)* +- ! Package the broker deployment `32d1411b` + *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)* +- ! Integrate an upstream identity provider `6697a994` + *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)* +- ! Define federated assurance `d845380d` + *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)* +- ! Verify IAM conformance and coexistence `9cb7fd93` + *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)* +- ! Enforce tenant and platform boundaries `38998c68` + *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)* +- ! Prove recovery and audit delivery `e5f44ddc` + *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)* +- … and 1 more open tasks + +--- +## MCP Orientation (when available) + +If the state-hub MCP server is reachable, call: +`get_domain_summary("infotech")` +This provides richer cross-domain context. +If the MCP call fails, use this file as your orientation source. diff --git a/docs/changes/netkingdom-target-2026-10-17/netkingdom-publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/netkingdom-publication-backup/WORK-RECORDS.md.worktree new file mode 100644 index 00000000..e6f84275 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/netkingdom-publication-backup/WORK-RECORDS.md.worktree @@ -0,0 +1,272 @@ +# Work Records — net-kingdom + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md | +| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md | +| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md | +| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md | +| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md | +| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md | +| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md | +| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md | +| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md | +| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md | +| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md | +| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md | +| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | +| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | +| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | +| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md | +| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md | +| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md | +| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md | +| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md | +| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md | +| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md | +| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md | +| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md | +| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md | +| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md | +| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md | +| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T14 | todo | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T15 | todo | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T33 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | +| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | +| intake | NET-IN-0001 | open | — | intakes/intakes.md | +| intake | NET-IN-0002 | open | — | intakes/intakes.md | +| intake | NET-IN-0003 | open | — | intakes/intakes.md | +| intake | NET-IN-0004 | open | — | intakes/intakes.md | diff --git a/docs/changes/netkingdom-target-2026-10-17/netkingdom-publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/netkingdom-publication-backup/originals.json new file mode 100644 index 00000000..1be7eb91 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/netkingdom-publication-backup/originals.json @@ -0,0 +1 @@ +{".custodian-brief.md": "100644 ea9ccd0b2bd2cc1ec89723b35c44c53f0d79ba98 0\t.custodian-brief.md\n", "WORK-RECORDS.md": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md\n"} \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-net-kingdom.json b/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-net-kingdom.json new file mode 100644 index 00000000..889bc2d3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-net-kingdom.json @@ -0,0 +1,130 @@ +{ + "schema": "custodian.nk48-1.3-owner-review.v1", + "owner": "net-kingdom", + "reviewed_on": "2026-10-17", + "reviewer": "net-kingdom owner session (Claude Code, fresh session started in ~/net-kingdom; no context from any authoring or reviewing session; source read from git archive into scratch only)", + "request": "nk48-1.3-owner-review/net-kingdom.md (with README.md and the carried duties of ../nk48-t16-owner-review/README.md)", + "frozen_target": { + "net_kingdom": "1920b134e2b577e74aaac6b59db5fd785f505a3d", + "kernel": "ops-warden a45cf47 (src only, read as the admission contract)", + "hashes_verified": { + "security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml": "sha256:3c05a749f28fa25df4d72aa1482a21be4ecc53af44ad17762d673588e2b3a947", + "sso-mfa/k8s/keycape/descriptor-composition-1.3.candidate.json": "sha256:64355c314891f7fc951a14e55c197609e892e73628acd43a535974382136961b", + "sso-mfa/k8s/keycape/keycape-registration-adapter.py": "sha256:021eee262ea5d23d46258ed819da57b331f07b814adcafd60e0941214be02aea", + "sso-mfa/k8s/keycape/ensure-groups-adapter.py": "sha256:e631134f20713d441b72ad7a9f49062b48925c4b6051b32bcfe9dadafff89b71", + "sso-mfa/k8s/keycape/bind-env-adapter.py": "sha256:800e45ecb68cc782c91aafda4242e0034e4156a54f6729d9f61fb845d4325d50" + }, + "hashes_match": true + }, + "reproduction": { + "validate_type": "OK oidc-browser-relying-party@1.3 (proposed)", + "package_tests_1_3": "22 passed (export extracted into a directory named net-kingdom, per r4 O1)", + "adapter_tests": "test_admit_1_3_type.py, test_ensure_groups_adapter.py, test_bind_env_adapter.py, test_keycape_registration_adapter.py, test_compose_1_2_descriptors.py against ops-warden a45cf47 src: 66 passed, 51 subtests passed", + "map_check": "type.yaml execution_descriptors equals descriptor-composition-1.3.candidate.json for all seven steps; the three net-kingdom digests equal the request table" + }, + "descriptor_verdicts": { + "register-client": { + "digest": "sha256:3ccc8eed545cf31f8a48feb8afa0c1355e126d9549eef9737d92d0c1b87708a8", + "verdict": "accept", + "scope": "as a successor-candidate descriptor for 1.3; conditional on the required type change below, which does not alter this digest", + "reasons": [ + "The adapter runs the step's declared entry point: keycape-client.py apply with the case, the case-acceptance record and the check-config binary, through the same helper the step names. The checker is pinned by exact digest and run from an immutable snapshot (checker_snapshot), so a refused registry never reaches the restart (type key-cape R1).", + "Within the step's auth and lane: descriptor actor human, lane key-cape-oidc-login, effect change, allowed_created exactly keycape-client, retry_safe false, revocation scope parent-session. build() refuses any invocation whose step, owner, actor or lane differs, a case or descriptor pin that differs, or a case target other than client_id.", + "Created-only rollback: only an authenticated case-created client is removed; a native revision change since creation goes to owner reconciliation. reconcile_original is read-only and never replays or undoes.", + "The parent session is revoked in every attempt and its evidence is required; owner evidence identifiers cannot be reused.", + "The registry write itself is an injected capability. No live registry, Secret or credential handling is in the adapter, which matches the step's rule that agents do not read or write Secrets." + ] + }, + "ensure-groups": { + "digest": "sha256:4411b5cb8944ee76ca1ade62c0c246f061981fb18f0b9afd05934a8935598dc3", + "verdict": "accept", + "scope": "as above", + "reasons": [ + "The adapter calls the provisioner's ensure_service_groups with exactly the case's access_groups and initial_members. It refuses duplicate groups and members named for a group outside access_groups, matching 'members exactly {initial_members} ..., nothing else'.", + "The injected provisioner must carry a PostgresGroupProvenance whose binding names this case digest, this principal and the reviewed source digest (T14 seam). SQLite, missing or differing journals are refused.", + "No provisioner or user-engine token is read or sent by the adapter. The in-pod transport through the session's contained cluster access is an injected stand-in (carried item 5).", + "Rollback revokes only journal-confirmed creations, preserves preexisting and shared groups and memberships, and deletes a group only when delete_if_empty is explicitly set (default false).", + "Source digest covers the adapter plus provisioner.py, group_provenance.py and group_provenance_postgres.py and is re-checked on every attempt. 1.1 stays the default version root; 1.3 is reachable only with version_root='1.3'." + ] + }, + "bind-env": { + "digest": "sha256:d2511dce3d2ff1d380f845920aa168e6fe09c0f0c382482a796a5bf13619905d", + "verdict": "accept", + "scope": "as above", + "reasons": [ + "The adapter adds exactly one env entry to the keycape container of Deployment sso/keycape. The name comes from the maintained helper (KEYCAPE_{client_id:env}_CLIENT_SECRET) and the source is a secretKeyRef to sso/keycape-{client_id}-client. Literal values are refused (reference-only check), so value_handling none holds.", + "Public clients are refused (no secret to bind), matching the step's when: client_type == confidential.", + "Write is compare-and-swap on the observed resourceVersion. An existing name bound to another source, or a duplicate, is refused. Ambiguous readback goes to owner reconciliation.", + "Rollback removes only an entry this process created, authenticated and still byte-identical. A Deployment changed since creation is refused for owner reconciliation.", + "--allow-unimplemented is refused. Actor human, lane key-cape-oidc-login, parent-session revocation required." + ] + } + }, + "type_level_verdict": { + "verdict": "needs change", + "summary": "The descriptor map and the follow-through text of 1.3 describe different trust transitions. The map makes all seven steps admissible to Warden's kernel, but the follow-through still carries 1.2's warden_executes and attended values unchanged (diff confirms). For register-client, ensure-groups and bind-env it says warden_executes: false, attended: true, auth 'operator ...'. Canon security-case-types_v0.1 and ops-warden case_type.py (FT-ATTEND: 'a step is either warden_executes or attended, not both') both define an attended step as one Warden never executes. A founder acknowledgment of 1.3 as written would acknowledge text that contradicts the map, and `warden plan` would still render these steps ATTENDED or owner while the kernel can dispatch them. Option A as framed in the T16 packet said 'warden_executes: true where Warden will dispatch'; the candidate did not carry that into the step text.", + "required_changes": [ + { + "id": "NK-1.3-C1", + "change": "Re-freeze the 1.3 candidate (still proposed and unacknowledged, so the version number may stay 1.3) so that each follow_through step in execution_descriptors states how it runs under the map. For the three attended net-kingdom steps, keep attended: true and warden_executes: false (the validators forbid both true). Change auth and entry_point so they name the reviewed adapter as run by Warden's case kernel inside the one attended human session: descriptor actor human, lane key-cape-oidc-login, parent-session revoked per attempt. Extend attended_justification to say the human session is the authority and the kernel is only the dispatcher. The owner-path steps get the same treatment from their owners (see question 3).", + "effect_on_digests": "Type text only. Descriptor digests do not encode the type (r4 O6), so the map and all seven descriptors are unchanged. The type.yaml digest changes, and so does the parameter fingerprint only if parameters are touched (they must not be). These reviews then re-freeze on the new type digest only." + }, + { + "id": "NK-1.3-C2", + "change": "net-kingdom canon: add a clarification to security-case-types_v0.1 (next to the 2026-10-09 warden_executes clarification) saying that a step listed in execution_descriptors is kernel-admissible whatever its warden_executes value. For an attended step, 'kernel-dispatched' means the reviewed adapter runs only inside the attended human session (actor human, parent-session revocation) and never under an agent or standing credential. warden_executes keeps its caller-proxy meaning for unattended steps. This is net-kingdom's own standard and is done in a net-kingdom session, not here.", + "effect_on_digests": "none on the type or descriptors" + } + ], + "not_required_for_1_3": [ + "The ensure-groups binding API change (see ensure_groups_parity) is a follow-up and must not be folded into this re-freeze, because it would move the ensure-groups and provisioner digests and need another source review." + ] + }, + "open_questions": { + "question_2_mint_semantics": { + "decided_with": "railiance-platform", + "net_kingdom_answer": "The type text is consistent as written. Keep mint-secret warden_executes: true, attended: false. Do not change it to attended.", + "reasons": [ + "Making it attended: true is invalid. net-kingdom's validator (security_case_validator.py:330) and Warden's case_type.py (FT-VALUE) both refuse value_handling generated_in_custody in an attended session, and FT-ATTEND refuses warden_executes together with attended.", + "Canon defines warden_executes: true as Warden invoking the owner's entry point through its caller proxy, under the caller's identity and lane, with no standing credential. The keycape-client-secret-generate lane's aal2 human OIDC login (net-kingdom-admins, agents and root refused) is that caller identity. It is not an attended session, because the value is generated in custody and no operator handles it. The descriptor's actor human is the machine form of the same rule, and Executor.admit enforces it for effect mint (actor human and WARDEN_AGENT_ID unset).", + "The step text should say so explicitly in the C1 re-freeze: 'a human caller (aal2) starts it; Warden runs it unattended through the broker lane'. This is wording only, not a semantic change." + ], + "defers_to": "railiance-platform for whether the broker lane accepts a Warden-proxied call under the caller's aal2 token as written in its catalog entry" + }, + "question_3_steps_in_the_map": { + "decided_with": "ops-warden", + "net_kingdom_answer": "Keep all seven in the map, as the founder chose under option A, with the C1/C2 type and canon text that says how each is dispatched. A partial map would not fit option A, and T16 refuses a partial map for admission.", + "conditions": [ + "For net-kingdom's three attended steps, the kernel must dispatch them only inside the attended human session. At a45cf47, Executor.admit enforces 'human, not agent' by environment only for effect mint. For effect change it relies on the verified caller-session:human::key-cape-oidc-login evidence. ops-warden must confirm that its session authenticator refuses an agent-held session for that purpose; otherwise the attended justification (agents do not write the registry Secret) is not enforced.", + "The owner-path steps (deliver-secret, deliver-consumer-secret, hand-over) stay in the map only if railiance-platform and railiance-apps each accept their descriptors. If either rejects, that step leaves the map, the composer's complete_executable_descriptor_set rule must be changed explicitly for 1.3, and these reviews re-freeze.", + "Lane fit, for ops-warden's catalog-routing-acceptance: the three net-kingdom steps use lane key-cape-oidc-login. At a45cf47 the catalog lists it as 'Interactive login, OIDC token, or MFA' (owner_repo key-cape, warden_executes false, risk standard). It is a login lane, not a reviewed change lane for the KeyCape registry, the sso/keycape Deployment or the provisioner pod. ops-warden decides whether that lane may carry kernel-dispatched change steps or whether 1.3 needs a dedicated attended change lane. If a new lane is needed, the descriptor lane field moves, all three net-kingdom digests change, and this review re-freezes." + ] + }, + "section_6_major_change": { + "confirmed_major": true, + "reasons": "Moving execution of six steps from the owner or an attended operator to Warden's kernel dispatch is a changed trust transition under canon security-case-types_v0.1 section 6. It needs a Decision Memo and founder informed-decision acknowledgment. Canonical 1.1 stays the default.", + "diff_1_2_to_1_3": "Verified directly: only metadata.version '1.2'->'1.3', status acknowledged->proposed, an appended comment and the seven-entry execution_descriptors map. Parameters, composition, materialization, follow_through, verification, rollback and acceptance are byte-identical. The 1.2 decision/ directory is not carried over, so 1.2's acknowledgment is not inherited. That unchanged follow_through is exactly the problem NK-1.3-C1 fixes." + } + }, + "ensure_groups_parity": { + "decision": "yes, expose a public API, but as a follow-up and not in 1.3", + "reasons": "ensure-groups-adapter.group_binding duplicates identity-provisioner Provisioner._group_binding (a private static method used for journal reserve and claim_revoke), and only test_public_group_binding_matches_provisioner holds the two copies equal. That fails closed in review but not at runtime. The provisioner should own one public module-level function (for example group_provenance.group_binding), which both Provisioner and the adapter import. Doing it now would change the ensure-groups source digest and its descriptor and would need an r5 source review, so it waits for the next descriptor revision.", + "task": "net-kingdom follow-up under NK-WP-0048 (to be added to the workplan in a net-kingdom session): public group_binding in identity-provisioner, adapter imports it, parity test removed, new descriptor in the next successor revision" + }, + "carried_items": { + "1_composer_vs_kernel_admission_fixture_only": "accept as a known limit. Real admission is proved only when ops-warden records native evidence trust (its review).", + "2_import_time_vs_build_time_drift": "accept as a known limit. register-client and bind-env execute helper modules at import but re-check source digests at build and on every attempt, and refuse on drift. A process that keeps running after the source changes refuses the next attempt instead of executing new code unreviewed.", + "3_version_selection_by_case_pin": "accept as a known limit for register-client and bind-env (helper CASE_TYPE regex accepts any @1.x). Version binding comes from the acknowledged type's map plus the case pin (r4 O6). It is safe only while no two acknowledged revisions share a descriptor digest with different step semantics. Any future revision that changes a step's meaning must also change its adapter source.", + "4_closure_test_import_time_only": "accept as a known limit", + "5_injected_stand_ins": "turn into a task. net-kingdom must bind real implementations for its capabilities before T06: the KeyCape registry read/write and readback, the sso/keycape Deployment CAS read/write, the provisioner in-pod transport through the session's contained cluster access, and owner evidence publish/authenticate. This is native-binding work under NK-WP-0048 (T06 path), not T16.", + "6_mint_then_revocation_failure_uncertain": "mint is railiance-platform's step. For net-kingdom's three steps the same pattern applies: a failed parent-session revocation raises after the effect, and the kernel records uncertain for owner reconciliation. Accept as a known limit." + }, + "other_notes": [ + "bind-env changes the sso/keycape pod template, so applying it starts a KeyCape rollout immediately, before register-client. The quiet-window restart is reviewed separately ('Not in T16'), but the attended session runbook must treat bind-env as the start of the quiet window.", + "T16 composition pointer: T16 still names Custodian native-registration-r1/descriptor-composition.json. Once these reviews re-freeze, it should point to net-kingdom sso-mfa/k8s/keycape/descriptor-composition-1.3.candidate.json at the frozen commit. That edit happens in a net-kingdom session; it is not made here.", + "The checker artifact pin (check_config_digest sha256:be37738f...ccff5) is part of register-client's source digest. Its storage and custody belong to key-cape's review." + ], + "re_freeze_required": true, + "re_freeze_scope": "type.yaml text only (NK-1.3-C1), plus the net-kingdom canon clarification (NK-1.3-C2). All seven descriptor digests are unaffected, unless ops-warden requires a different lane (question 3).", + "grants": "none. This is an owner verdict only. It records no owner-descriptor-acceptance evidence and no type acknowledgment, pin or native authority.", + "hard_limits_observed": "source only; no live or native action, no kubectl, SSH, OpenBao or secret access; net-kingdom and ops-warden not edited (read through git archive into scratch); no hub writes; only this file written" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-ops-warden.json b/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-ops-warden.json new file mode 100644 index 00000000..cabba87e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-ops-warden.json @@ -0,0 +1,122 @@ +{ + "schema": "custodian.nk48-1.3-owner-review.v1", + "owner": "ops-warden", + "reviewed_on": "2026-10-17", + "reviewer": "ops-warden owner session (Claude Code, fresh session started in ~/ops-warden; source read with git show only; no tests executed in this session)", + "request": "nk48-1.3-owner-review/ops-warden.md (with README.md and the carried duties of ../nk48-t16-owner-review/README.md)", + "frozen_target": { + "net_kingdom": "1920b134e2b577e74aaac6b59db5fd785f505a3d", + "kernel_requested": "ops-warden a45cf47", + "kernel_current_head": "ops-warden 117fec9 (fix(case): validate original intent and bind its running receipt)", + "hashes_verified": { + "net-kingdom:security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml": "sha256:3c05a749f28fa25df4d72aa1482a21be4ecc53af44ad17762d673588e2b3a947", + "net-kingdom:sso-mfa/k8s/keycape/descriptor-composition-1.3.candidate.json": "sha256:64355c314891f7fc951a14e55c197609e892e73628acd43a535974382136961b", + "ops-warden@a45cf47:src/warden/case_run.py": "sha256:0574036ca7b74bdb9124f6af4888e63ec231ee60f5c9f34cbe2fb1acee39f671", + "ops-warden@117fec9:src/warden/case_run.py": "sha256:77e8117a1fb4e039815b555797778f7180f11e30f64cebe51b350b3eb7e46768", + "ops-warden@a45cf47=117fec9:src/warden/case_inputs.py": "sha256:1334b0cd9897e763cfea2d306e997c659f3f284ecc3f9612140c2104835da7c7", + "ops-warden@a45cf47=117fec9:src/warden/case_plan.py": "sha256:9352ae8683d1181980c4ff38524582e4be448d33c85b558f60582c1e5bb5bbaa", + "ops-warden@a45cf47=117fec9:registry/routing/catalog.yaml": "sha256:c47065c0892fd0bd07c2bffab95884e7e907832eef3623c4d69d6ad3b01ebc53" + }, + "hashes_match": true + }, + "reproduction": "Not run in this session. Findings are from source reading (case_run.Executor.admit, case_inputs.PARAMETER_PINS, case_plan mode derivation, catalog.yaml) and from the net-kingdom 1.3 README and owner review. The coordinator should re-run test_admit_1_3_type.py and the registration adapter tests against ops-warden 117fec9 (see KERNEL-1).", + "descriptor_verdicts": "ops-warden owns no step descriptor in the 1.3 map. It owns the admission kernel, the routing catalog, and therefore catalog-routing-acceptance, which admit binds to digest(catalog_source) for every step.", + "kernel_verdict": { + "verdict": "needs change", + "summary": "ops-warden will not give catalog-routing-acceptance or admit 1.3 on kernel a45cf47 or catalog c47065c0. a45cf47 is superseded: 117fec9 fixed four reproduced defects in the original-intent path that the 1.3 registration adapter's reconcile_original depends on. The catalog does not route three of the seven descriptor lanes. Admission does not check that a descriptor's lane is in the accepted catalog, and does not check that the step's plan mode is consistent. None of these changes a type or descriptor digest, except OW-1.3-C1 below." + }, + "open_questions": { + "question_1_parameter_pin": { + "answer": "Yes. ops-warden will add \"1.3\": \"c04385d176f5f70257fb0fa6fef7e48ab26ed7cf26f6b1c7f14b16237b0ebea6\" to PARAMETER_PINS, under conditions.", + "conditions": [ + "Only after the re-frozen 1.3 type (NK-1.3-C1 and OW-1.3-C1) exists, and the founder has acknowledged that exact type digest through informed-decision. Pinning before the acknowledgment would let the kernel pre-authorize text that has not been acknowledged.", + "The fingerprint is recomputed from the acknowledged type bytes with the same _VALIDATE path in an ops-warden session, not copied from 1.2. If the re-freeze changes any parameter byte, the pin follows the recomputation and these reviews re-freeze.", + "The commit adds a test proving that 1.3 and 1.2 share the fingerprint, and that an unacknowledged or differently parameterised 1.3 is still refused.", + "The pin lands in a kernel revision that already contains KERNEL-1..3. It is not added to a45cf47." + ], + "note": "r4 O6 is accepted. Because no descriptor encodes the type version, the version binding is PARAMETER_PINS plus the case pin plus the acknowledged type's execution_descriptors map. ops-warden treats the pin as one of three required legs, never as authority by itself." + }, + "catalog_routing_for_seven_lanes": { + "answer": "catalog-routing-acceptance covers the whole catalog digest, so ops-warden gives it only for a catalog that routes every lane named by the 1.3 map, with entries that match how each step is dispatched.", + "per_lane": { + "keycape-client-secret-generate (mint-secret)": "Present (risk high). Acceptable for the mint, conditional on railiance-platform confirming the broker accepts a Warden-dispatched call under the caller's aal2 token (net-kingdom question 2 defers to it).", + "key-cape-oidc-login (ensure-groups, bind-env, register-client)": "Not acceptable as written. It is a login lane (risk standard, warden_executes false, 'Interactive login, OIDC token, or MFA'). Under ADR-0005 and ADR-0008, a login lane cannot also act as the authority for kernel-dispatched changes to the KeyCape registry, groups and Deployment env, and its risk grade does not cover what those paths disclose. See OW-1.3-C1.", + "platform-secret-delivery (deliver-secret)": "Missing. Needs a new entry.", + "consumer-owner-deployment (deliver-consumer-secret, actor agent)": "Missing. Needs a new entry.", + "apps-consumer-handover (hand-over)": "Missing. Needs a new entry." + }, + "each_new_entry_requires": [ + "Pointer-only content (ADR-0001): owner_repo, the owner's front door or entry point by reference, and no copied procedure.", + "An explicit risk grade (ADR-0007) that covers every field the path discloses (ADR-0008). deliver-secret and deliver-consumer-secret move client-secret material, so they are graded risk: high.", + "A delegation block (ADR-0003). native where the owner's own path executes, for example Platform ESO or the Apps consumer deployment; otherwise interim, with intended_owner and blocked_on.", + "For consumer-owner-deployment, whose descriptor actor is agent: the agent read-boundary (ADR-0004) applies. The entry and the adapter must show that no raw value reaches the agent session, only owner-side delivery. If that cannot be shown, the actor is changed to human and the railiance-apps digest changes.", + "The owning repo (railiance-platform for platform-secret-delivery, railiance-apps for the other two) confirms that the pointer is correct before the entry is promoted from draft to active (wiki/playbooks/catalog-lane-promotion.md).", + "Entries are authored in an ops-warden session and committed. The resulting catalog digest is the one catalog-routing-acceptance names." + ] + }, + "question_3_owner_path_and_attended_steps": { + "decided_with": "net-kingdom", + "answer": "Admit all seven, as option A requires, but not blindly. Admission must read the step's plan mode and enforce mode-specific constraints. Refusing every non-warden mode would contradict option A. Ignoring the mode, as a45cf47 does, lets the kernel dispatch steps that warden plan renders as ATTENDED or owner.", + "required_kernel_behaviour (KERNEL-3)": [ + "mode warden (warden_executes true): as today. Caller proxy, actor and lane equal to the descriptor, human for mint.", + "mode attended: actor must be human and WARDEN_AGENT_ID unset. The caller-session lane must equal the step's declared attended lane, with parent-session revocation evidence per attempt. Dispatch happens only inside that attended session.", + "mode owner: Warden must not hold or broker an owner credential (ADR-0002). The descriptor's lane must resolve in the catalog to a delegation: native entry whose owner_repo equals descriptor.owner. Warden triggers or observes the owner's own path, and owner evidence authenticates the result.", + "The type's warden_executes and attended values must agree with the descriptor (consistent with ops-warden's own case_type.py FT-ATTEND rule). A descriptor whose step text does not state how the kernel dispatches it is refused. This is why ops-warden supports NK-1.3-C1." + ] + }, + "kernel_review_original_intent": { + "answer": "Yes. An independent review is required before ops-warden accepts, and it must be of 117fec9, not a45cf47.", + "reasons": [ + "117fec9 fixed four reproduced defects in the a45cf47 interface: original actor mismatch, payload/SQL attempt-ID mismatch, an orphan intent without its running receipt, and arbitrary values accepted by the original-intent serializer. a45cf47 is therefore not an acceptable admission target for a reconcile path.", + "The Custodian folders original-context-r1, compare-r2 and owner-followthrough-r3 are the defect comparison and the fix by the authoring line. They are not an independent review of the resulting interface.", + "The 1.3 registration adapter defines reconcile_original (keycape-registration-adapter.py around line 232). Its reconcile path depends directly on this contract, and was written against a45cf47 behaviour. It must be re-checked against 117fec9.", + "The 117fec9 docs state that local dispatch correspondence is not owner proof. WARDEN-WP-0044-T03 stays a native acceptance gate, which this review does not change." + ] + } + }, + "required_changes": [ + { + "id": "OW-1.3-C1", + "scope": "1.3 candidate (net-kingdom descriptors) and the ops-warden catalog", + "change": "Replace lane key-cape-oidc-login in the ensure-groups, bind-env and register-client descriptors with a dedicated attended change lane, for example keycape-attended-case-change. ops-warden adds that lane to the catalog: owner_repo key-cape/net-kingdom, attended, risk high, and a delegation record. The lane's session may itself be established by a key-cape OIDC login. The login lane stays the identity step, not the change authority.", + "effect_on_digests": "The three net-kingdom descriptor digests change, so the type's execution_descriptors map changes. Combined with NK-1.3-C1 into one re-freeze." + }, + { + "id": "KERNEL-1", + "scope": "ops-warden kernel (no 1.3 digest change)", + "change": "Move the frozen kernel target from a45cf47 to 117fec9 or a successor. Commission an independent review of the original-intent interface at that revision, and re-run test_admit_1_3_type.py and the registration adapter tests against it." + }, + { + "id": "KERNEL-2", + "scope": "ops-warden kernel", + "change": "Executor.admit resolves descriptor.lane in the parsed catalog_source and refuses a lane that is missing or not active, or whose owner_repo, delegation or risk does not fit the descriptor. Today catalog-routing-acceptance covers the catalog digest, but nothing ties a descriptor's lane to an entry in it." + }, + { + "id": "KERNEL-3", + "scope": "ops-warden kernel", + "change": "Mode-aware admission as described under question 3." + }, + { + "id": "CATALOG-1", + "scope": "ops-warden catalog", + "change": "Add platform-secret-delivery, consumer-owner-deployment and apps-consumer-handover per catalog_routing_for_seven_lanes, plus the OW-1.3-C1 lane, and promote them after owner confirmation." + }, + { + "id": "PIN-1", + "scope": "ops-warden kernel", + "change": "Add the 1.3 parameter pin under the conditions of question 1. This is last in order, after the founder acknowledgment." + } + ], + "carried_items": { + "1_admission_proved_by_fixture_only": "Turned into tasks. KERNEL-2 and KERNEL-3 plus a test that admits the real re-frozen type with pinned descriptors, then native trust under WARDEN-WP-0044-T03.", + "2_import_vs_build_time_drift": "Accepted as a known limit for 1.3. The kernel re-pins adapter source at admission ('unknown adapter or owner source pin'). Owners keep the per-attempt re-read.", + "3_no_adapter_selects_type_version": "Accepted as a known limit, given the three-leg binding in question 1 (PARAMETER_PINS, case pin, acknowledged map). ops-warden owns that binding.", + "4_closure_test_import_time_only": "Accepted as a known limit for source review. Not sufficient for native admission. Revisit under T03.", + "5_owner_capabilities_are_stand_ins": "Accepted as a known limit for this review only. Native admission requires real owner capabilities with independent authenticated evidence (T03 gate, unchanged).", + "6_mint_ok_revoke_failed_uncertain": "Accepted as a known limit. The step stays UNCERTAIN for owner reconciliation. Recovery counts only with authenticated owner evidence, never from Warden's local original-intent record (117fec9 boundary)." + }, + "re_freeze_required": true, + "re_freeze_scope": "One combined re-freeze of the 1.3 candidate: NK-1.3-C1 (type text) and OW-1.3-C1 (three net-kingdom descriptor lanes, changing their digests and the map). If railiance-apps keeps actor agent but cannot show the ADR-0004 boundary, the deliver-consumer-secret digest changes too. KERNEL-1..3, CATALOG-1 and PIN-1 are ops-warden changes. They move the kernel and catalog targets and do not change the type, but every owner review must name the new kernel and catalog revisions.", + "grants": "none. This is an owner verdict only. It records no catalog-routing-acceptance or other evidence, no pin, and no type acknowledgment.", + "hard_limits_observed": "source only. No live or native action, no kubectl, SSH, OpenBao or secret access. net-kingdom and ops-warden were not edited (read with git show). No hub writes. Only this file was written." +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-apps.json b/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-apps.json new file mode 100644 index 00000000..9be78103 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-apps.json @@ -0,0 +1,122 @@ +{ + "schema": "custodian.nk48-1.3-owner-review.v1", + "owner": "railiance-apps", + "reviewed_on": "2026-10-17", + "reviewer": "railiance-apps owner session (Claude Code, fresh session started in ~/railiance-apps; no context from any authoring or reviewing session; source read from git archive into scratch only)", + "request": "nk48-1.3-owner-review/railiance-apps.md (with README.md and the carried duties of ../nk48-t16-owner-review/README.md)", + "grants": "nothing: no admission, pin, dispatch, evidence, acknowledgment or native action", + "overall": "needs-change", + "frozen_target": { + "net_kingdom": "1920b134e2b577e74aaac6b59db5fd785f505a3d", + "kernel": "ops-warden a45cf47 (src only, read as the admission contract)", + "hashes_verified": { + "security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml": "sha256:3c05a749f28fa25df4d72aa1482a21be4ecc53af44ad17762d673588e2b3a947", + "sso-mfa/k8s/keycape/descriptor-composition-1.3.candidate.json": "sha256:64355c314891f7fc951a14e55c197609e892e73628acd43a535974382136961b", + "sso-mfa/k8s/keycape/deliver-consumer-secret-adapter.py": "sha256:fc34f750814bc85616aae158c81a8d9453ecf09ba3acdff0eba1d0eaeab911f5", + "sso-mfa/k8s/keycape/handover-adapter.py": "sha256:34dcae7ce19f6c7c8c8bb79f6b08e4c11be65269545cf739a9152e3d4dfe9b82", + "sso-mfa/k8s/keycape/deliver-consumer-secret-adapter.md": "sha256:9ba60283eab80bdf41e20689ba206ac5ba175adcf8c28ab1ae8e04e5072358c0", + "sso-mfa/k8s/keycape/handover-adapter.md": "sha256:9c2103b33d71434551768746d72eb4a96998ba38d5a6fbdbf3266b0b2abf7dd4" + }, + "hashes_match": true, + "adapter_py_hashes_equal_coordinator_r4": true + }, + "reproduction": { + "tests": "test_deliver_consumer_secret_adapter.py, test_handover_adapter.py, test_admit_1_3_type.py against ops-warden a45cf47 src: 24 passed, 49 subtests passed", + "digest_recompute": "Loaded both adapters from the clean export and built descriptor('railiance-apps'): adapter_source sha256:8ec63233218f2f9571e1f0605ae29b4378f3126d0ff7f5192e35efa4291f72cd and sha256:ceaefd44168fa49d4ab1bb0f4870fe43ffd3b6a963b59d53970c97b1ed871155; descriptor digests equal the request table and type.yaml execution_descriptors (9c289f64..., 84f0fac4...)." + }, + "prior_apps_record": { + "path": "railiance-apps docs/evidence/nk48-t16-owner-review/owner-review-railiance-apps.json (commit 9b0999f, against 1.2 at ff8f597)", + "status_in_1_3": "Both needs-change findings are still open. The 1.3 diff to these two adapters only adds 1.3 version selection (r4 check_1); the actor and the verifier contract are unchanged. Apps preferred option C there; the founder chose A, and this review works within A." + }, + "descriptor_verdicts": { + "deliver-consumer-secret": { + "digest": "sha256:9c289f646516923a4c448a2d3cdd45b33115516e6a171b7955924d8b5d852d2b", + "verdict": "reject", + "accept_when": "RAPPS-1.3-C1 is made. Apps then expects to accept the new digest without further change to the adapter logic.", + "reasons": [ + "Actor 'agent' does not match how Apps can apply to the production forgejo namespace. Apps' only deployment authority there is the operator kubeconfig used by Make targets, and production-touching applies need the founder's go per change (repo rules: '*-deploy change production workloads, operator approval required'). No contained, namespace-scoped agent deployer identity exists, and Apps does not want one created for this step: it would be a new standing credential that an agent session could trigger. With actor agent, Warden would admit a dispatch for which Apps has no lawful owner_apply.", + "Everything else in the descriptor and adapter is what Apps designed and will implement: the three objects and their fixed metadata match Apps' own proposal docs/proposals/2026-10-11-forgejo-consumer-eso/ (SA forgejo/forgejo-keycape-forgejo-eso automount false, SecretStore openbao-keycape-forgejo-consumer with audiences [openbao] and role external-secrets-keycape-forgejo-forgejo, ExternalSecret forgejo-netkingdom-oidc-client with Owner/Retain and only CLIENT_SECRET from workloads/keycape/forgejo). Lane, effect change, allowed_created, retry_safe false and parent-session revocation are accepted.", + "Receipt contract netkingdom.consumer-secret-delivery.v1, the value-free rule, uid binding and created-only rollback in the order ExternalSecret, SecretStore, SA are accepted as written." + ], + "owner_notes": [ + "The adapter checks consumer_reference_reverted only after owner_remove has returned, so it cannot stop a removal that ran before the revert. Apps' owner_remove will enforce the order itself: Forgejo Helm rollback to the noted revision first, then removal. This is an Apps implementation duty, not a candidate change.", + "Unlike hand-over, build() does not check a case_acceptance pin. Kernel admission already requires authenticated case acceptance, so Apps does not require a change; net-kingdom may align it in the C1 re-freeze if it wants." + ] + }, + "hand-over": { + "digest": "sha256:84f0fac401ea2f1e7c305fb1753a34838ac062655199fcfbbd998f39268c3000", + "verdict": "reject", + "accept_when": "RAPPS-1.3-C2 is made (adapter source change, new digest) and RAPPS-1.3-C3 is folded into the NK-1.3-C1 type text.", + "reasons": [ + "Actor human, lane apps-consumer-handover, effect change, allowed_created [handover-receipt], retry_safe false and parent-session revocation are accepted.", + "verify_consumer returns bare booleans (enforces_groups, login_verified). The observation digest bound into the kernel evidence covers only those booleans and the group list, so the evidence cannot show that login and group enforcement were observed at Forgejo rather than asserted. This is the question T16 puts to Apps ('not inferred from registry CAS'), and the adapter as written cannot carry the answer." + ] + } + }, + "required_changes": [ + { + "id": "RAPPS-1.3-C1", + "file": "sso-mfa/k8s/keycape/deliver-consumer-secret-adapter.py", + "change": "Descriptor actor 'agent' -> 'human'. The step then runs inside one attended Apps operator session, together with hand-over, on the founder's go for the change.", + "effect_on_digests": "The actor string is in the adapter source, so both adapter_source and the descriptor digest change. The type map entry for deliver-consumer-secret changes; all reviews re-freeze on the new map." + }, + { + "id": "RAPPS-1.3-C2", + "file": "sso-mfa/k8s/keycape/handover-adapter.py", + "change": "Extend the verify_consumer result contract with an 'observations' field: a bounded, value-free list of probe records, each {probe, evidence} where probe is one of 'member-login', 'non-member-refused', 'membership-add-grants', 'membership-remove-revokes' and evidence is an owner evidence identifier (IDENTIFIER pattern). Require exactly those four probes, refuse any value-bearing key, and include the field in the observation digest. Keep the existing boolean checks.", + "effect_on_digests": "adapter_source and the hand-over descriptor digest change; type map entry changes." + }, + { + "id": "RAPPS-1.3-C3", + "file": "security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml", + "change": "Type text only, to be folded into net-kingdom's NK-1.3-C1 re-freeze. (a) hand-over entry_point says the consumer configuration (Forgejo gitea.oauth values and group requirement) is the consumer owner's own Helm change, made before the step; the kernel-dispatched step verifies the consumer and records the receipt. (b) The hand-over rollback says the adapter removes only the receipt, and removing the OIDC source is the owner's Helm rollback, done inside deliver-consumer-secret's owner_remove before any object is removed. (c) Both steps name their lanes (consumer-owner-deployment, apps-consumer-handover) and say they run attended, actor human, in one consumer-owner session. Today the composition shows type_lane null for both.", + "effect_on_digests": "type.yaml digest only; descriptors unaffected (r4 O6)." + } + ], + "answers": { + "deliver_consumer_secret_path": { + "question": "deliver-consumer-secret creates a dedicated ServiceAccount, a SecretStore and an ExternalSecret in the consumer namespace, under CCR-2026-0042. It assumes ESO TokenRequest and controller-RBAC admission are already validated. Is that your path, and is actor agent right for it?", + "answer": "Yes, the objects and CCR-2026-0042 are Apps' path. Actor agent is not right; it must be human (RAPPS-1.3-C1).", + "detail": [ + "The ESO validation is part of Apps' owner admission, not something the adapter may assume once. Apps' 2026-10-11 read-only metadata observation (ESO v0.16.1, SecretStore CRDs with serviceAccountRef.audiences, controller RBAC permitting serviceaccounts/token create) is a snapshot. Apps' owner_apply will refresh it through PartialObjectMetadata before every apply, classify each of the three objects as absent, exact preexisting-matched or conflicting, and refuse on a legacy-token SA, audience or role mismatch, unknown ownership or a shared target. It never reads Secret data and never falls back to a static token or manual Secret seeding.", + "The ESO controller and its cluster-wide RBAC are railiance-platform's. Apps observes them; Platform owns any change to them.", + "The OpenBao role and policy (external-secrets-keycape-forgejo-forgejo, workload-kv-read-keycape-forgejo-forgejo) are materialized by Platform under CCR-2026-0042 before this step. deliver-consumer-secret must not run until Platform's materialization receipt exists." + ] + }, + "hand_over_observation": { + "question": "hand-over requires the consumer to enforce access_groups and a verified login before recording a hand-over receipt. Can your deployment path supply that observation?", + "answer": "Yes, as an attended observation at Forgejo, provided the adapter can bind it (RAPPS-1.3-C2).", + "detail": [ + "member-login: an attended browser sign-in through 'Sign in with netkingdom' by a member of a case access group succeeds with MFA, and the Forgejo admin API shows the account linked to auth source netkingdom.", + "non-member-refused: a NetKingdom test user in none of forge-admins, forge-coulomb-owners, forge-coulomb-readers is refused sign-in or gets no team access.", + "membership-add-grants / membership-remove-revokes: adding that user to a mapped group grants the mapped Forgejo team on next sign-in; removing it revokes the team. This is RAPPS-WP-0016-T03's acceptance test.", + "Each probe record carries client_id, the group probed, Forgejo user and team ids and a timestamp. No tokens, cookies or secret values. Nothing is inferred from registry CAS, the client registration or ExternalSecret Ready.", + "Receipt store: a committed evidence file in railiance-apps docs/evidence/-forgejo-netkingdom-handover.json; identifier path@commit; created=false when the same observation digest is already committed. remove_handover is a revert commit, confirmed only when it is on main.", + "Known Apps risk, not a candidate change: Forgejo's OAuth source takes one required-claim value, and the case lists three groups. Apps must check in T02/T03 whether 'one of access_groups' needs a common gate group or team mapping with no automatic account creation. The non-member probe is what shows whether enforcement holds." + ] + }, + "lanes": { + "question": "consumer-owner-deployment and apps-consumer-handover have no routing catalog entries. Are they real lanes of yours, or should these steps use existing ones?", + "answer": "They are real Apps lanes. Keep both names, which the founder confirmed. Both need new catalog entries; no existing entry fits.", + "detail": [ + "Existing entries do not fit: key-cape-oidc-login is key-cape's login lane; forgejo-admin-api-token is a secret lane for the Forgejo admin token, which these steps must not use.", + "Proposed entry content for ops-warden: owner_repo railiance-apps; holds no credential; attended human in an Apps operator session on the founder's go; deployment authority is the operator kubeconfig for railiance01, never a standing agent credential; values none.", + "consumer-owner-deployment is named generically while the owner is '{consumer_owner_repo}'. Another consumer owner needs its own catalog entry for its own deployment path; Apps' entry covers railiance-apps only.", + "ops-warden decides the catalog shape and records catalog-routing-acceptance. Apps writes no catalog entry here." + ] + } + }, + "carried_items": { + "1_composer_complete_set_fixture_admission": "Accepted as a known limit; net-kingdom and ops-warden's concern.", + "2_import_vs_build_drift": "Accepted as a known limit. Both Apps adapters rehash their single source file per attempt and import no helper modules.", + "3_no_type_version_selection": "Accepted as a known limit. deliver-consumer-secret selects by the case's spec.type (1.2 or 1.3) and relies on the kernel's case/type pin (r4 O6); hand-over selects by explicit version_root.", + "4_closure_test_import_time_only": "Accepted as a known limit.", + "5_injected_stand_ins": "Turned into a task: RAPPS-WP-0016-T05 (real owner_apply/owner_remove, consumer verifier with the four probes, committed-evidence receipt store). Apps will update T05's text to the 1.3 contract after the re-freeze.", + "6_mint_then_revoke_failure": "Platform's step; no Apps position." + }, + "apps_follow_ups": [ + "RAPPS-WP-0016-T02 says the custody path is 'read through role workload-kv-read-keycape-forgejo-forgejo'. That name is the policy; the Kubernetes-auth role is external-secrets-keycape-forgejo-forgejo. Correct the workplan text in a later Apps session (not done here: this session writes only this file).", + "RAPPS-WP-0016-T05 blocking_reason still points at the 1.2 option decision; update it to this 1.3 record." + ], + "not_reviewed": ["ensure-groups", "mint-secret", "deliver-secret", "bind-env", "register-client", "composer beyond the two Apps entries", "checker artifact", "kernel admission", "PARAMETER_PINS (question 1)", "mint semantics (question 2)"] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-platform.json b/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-platform.json new file mode 100644 index 00000000..5257826f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-platform.json @@ -0,0 +1,155 @@ +{ + "schema": "custodian.nk48-1.3-owner-review.v1", + "owner": "railiance-platform", + "reviewed_on": "2026-10-17", + "reviewer": "railiance-platform owner session (Claude Code, fresh session started in ~/railiance-platform with no context from any authoring or reviewing session; net-kingdom and ops-warden source read only from git archive in scratch)", + "request": "nk48-1.3-owner-review/railiance-platform.md (with README.md and the carried duties of ../nk48-t16-owner-review/README.md)", + "frozen_target": { + "net_kingdom": "1920b134e2b577e74aaac6b59db5fd785f505a3d", + "kernel": "ops-warden a45cf47 (src, read as the admission contract)", + "hashes_verified": { + "security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml": "sha256:3c05a749f28fa25df4d72aa1482a21be4ecc53af44ad17762d673588e2b3a947", + "sso-mfa/k8s/keycape/descriptor-composition-1.3.candidate.json": "sha256:64355c314891f7fc951a14e55c197609e892e73628acd43a535974382136961b", + "sso-mfa/k8s/keycape/mint-secret-adapter.py": "sha256:246323c7243ded18229ab063956577e151d56d9be485d3bd44fc38e5af0edf3c", + "sso-mfa/k8s/keycape/deliver-secret-adapter.py": "sha256:cd1a515a1ae2def2093660ed2a810a9c66d1d4cf7126f573ee7e9c4c42afb98d" + }, + "hashes_match": true, + "descriptor_digests_match_request": { + "mint-secret": "sha256:c92957227235db04953809d92b260d32c8b947472a8e8fd17a258ade3ae8da70", + "deliver-secret": "sha256:75aaa7346aebdea2a0eb0ba993995515b5248ffefc34caf8e713525e9b58da85" + }, + "platform_sources_reviewed": { + "repo": "railiance-platform 0a9617a62d4696a8070798923b459e8405c3dbf2", + "workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md": "status finished", + "scripts/keycape_client_secret_generate.py": "sha256:9576cd211cfc06526ec4cc9bd0a5b06f0f59287a68931bb2d6e3592a951ddc7d", + "openbao/policies/keycape-client-secret-generate.hcl": "sha256:4c37945600b2a32e3d3a78eb6ccd2e31cc2f2f1755e931cc6ad56565024c1496", + "credential-grants/catalog.yaml": "sha256:cb70165f80c58245d4231b4e712a4b322c51a6b168513dc839ad4c0234027047", + "credential-change-requests/CCR-2026-0040-keycape-client-secret-generate-grant.yaml": "sha256:f57ba6d44d7f72e62b7927a1f972baffc6dcb7d7baea6c686987ed2e7fbbdca4", + "credential-change-requests/CCR-2026-0043-keycape-client-secret-generate-issuer-binding.yaml": "sha256:84e44202d7d2dfad9955f00b461b587995ba275b05ff29fef94c085810758560", + "credential-change-requests/CCR-2026-0041-forgejo-netkingdom-oidc-keycape-eso-reader.yaml": "sha256:e69077ad29166770e4a57b4c4105615e272822d8fde11df591d0c127b158ac67 (the existing ESO reader pattern for platform/workloads/keycape/)", + "ops-warden a45cf47 registry/routing/catalog.yaml": "entry keycape-client-secret-generate (active); no entry platform-secret-delivery" + } + }, + "reproduction": { + "adapter_tests": "test_mint_secret_adapter.py, test_deliver_secret_adapter.py, test_admit_1_3_type.py against ops-warden a45cf47 src, export extracted into a directory named net-kingdom: 30 passed, 33 subtests passed. All owner capabilities in these tests are stand-ins." + }, + "descriptor_verdicts": { + "mint-secret": { + "digest": "sha256:c92957227235db04953809d92b260d32c8b947472a8e8fd17a258ade3ae8da70", + "verdict": "accept", + "scope": "as a 1.3 successor-candidate descriptor. Platform will give owner-descriptor-acceptance only after tasks RPF-1.3-T1 to T3 below exist and are done. None of them changes this digest.", + "reasons": [ + "Descriptor fields match the Platform lane: owner railiance-platform, lane keycape-client-secret-generate (ops-warden catalog entry active, owner_repo railiance-platform), actor human, effect mint, allowed_created exactly custody-secret-version, retry_safe false, revocation scopes parent-session and broker-grant. These are the lane's two credentials: the caller's 15m issuer OIDC session (CCR-2026-0043) and the 5m create-only grant token (CCR-2026-0040).", + "The custody path is derived from the admitted target only (platform/workloads/keycape/). The caller cannot choose a path, which matches the grant's single-segment keycape/+ reach and the broker's own client_id and reserved-entry checks.", + "The adapter never receives a value. It accepts only a closed six-key receipt with values_emitted false and refuses any other field. That is stricter than, and compatible with, the broker's rule that the value goes only to its own memory and the bao child's stdin.", + "retry_safe false fits the lane. A second run returns already_present (exit 3), which projects to created false, and the adapter refuses a mint that created nothing instead of claiming an existing entry.", + "Both revocations are attempted even if one fails. Their identifiers are required, and the kernel fixes the evidence names grant-revocation::... and session-revocation::..., so the evidence is bound to this lane." + ] + }, + "deliver-secret": { + "digest": "sha256:75aaa7346aebdea2a0eb0ba993995515b5248ffefc34caf8e713525e9b58da85", + "verdict": "accept", + "scope": "as a 1.3 successor-candidate descriptor, on two conditions. (1) The type change RPF-1.3-C1 goes into the NK-1.3-C1 re-freeze. (2) Platform defines the lane platform-secret-delivery (RPF-1.3-T4) and ops-warden catalogs it before any acceptance evidence is recorded. Neither condition changes this digest. If ops-warden refuses the lane name, the descriptor's lane field changes, this digest changes, and this verdict re-freezes.", + "reasons": [ + "The secret reference is derived only from the admitted target, matching the type and the existing ESO reader pattern (CCR-2026-0041): ExternalSecret sso/keycape--client, key client-secret, from platform/workloads/keycape/. A bounded DNS-label check applies to the name.", + "value_handling none holds. Receipts carry metadata only (namespace, name, custody_reference, key_names, uid/resource_version revisions, booleans), and any other field is refused.", + "Created-only rollback is sound. A pre-existing ExternalSecret is NO_CHANGE and never becomes a created object. Removal is allowed only for an authenticated case-created delivery, and only when the remove receipt shows before equal to the created revision and after null. Rollback ordering (deliver-secret before mint-secret/client-secret-path) is the kernel's reverse order and matches the type's rollback list.", + "actor human and the single parent-session scope are right. Delivery needs no broker grant. ESO, not the caller, reads custody through role external-secrets-keycape-, which materialization creates." + ], + "implementation_obligations_on_platform": [ + "Report NO_CHANGE only after Platform checks that the existing ExternalSecret's spec equals the case-derived one: store, remoteRef key platform/workloads/keycape/, property CLIENT_SECRET, target key client-secret. A differing pre-existing object must be refused, not reported as unchanged. The adapter cannot see the spec.", + "Return a deliver receipt only after status readback shows Ready=True (the type's ready_check, status only). netkingdom.deliver-secret.v1 has no ready field. Platform enforces it by refusing to issue a receipt, so the schema does not change.", + "Delete the ExternalSecret only by name with a uid and resource_version precondition equal to receipt 'after'. Delete its owned target Secret through the ownerReference, never by reading it." + ] + } + }, + "questions": { + "receipt_schemas": { + "answer": "Confirmed, value-free and producible, through a Platform projection layer. Neither schema is what Platform's tools emit today.", + "railiance-platform.custody-mint.v1": { + "fields": ["schema", "path", "operation", "version", "created", "values_emitted"], + "producible": true, + "source": "credential.py generate writes platform.keycape-client-secret-generate.v1, a superset with case_ref, grant, outcome, exit_code, kv_version, grant_token_revoked, value_reads and credential_values_emitted, and no value. The Platform mint capability runs the generator and projects to exactly the six keys: path; operation mint; version = kv_version (always 1, because the lane writes only with CAS 0); created = (outcome == generated); values_emitted = not credential_values_emitted. Any other outcome is created false, or raises with no receipt.", + "constraint": "The adapter accepts version >= 1. Platform will only ever return version 1 for mint and destroy, because this lane is first generation only (rotation is RPF-WP-0055, not this lane). No candidate change is needed." + }, + "netkingdom.deliver-secret.v1": { + "fields": ["schema", "operation", "namespace", "name", "custody_reference", "key_names", "values_emitted", "changed", "before", "after"], + "producible": true, + "source": "ExternalSecret metadata (uid, resourceVersion) and status conditions only. ESO's target Secret is never read. Platform has no deliver tool today (RPF-1.3-T4).", + "note": "The name carries the netkingdom. prefix although Platform produces it. The founder confirmed it by name, so Platform accepts it as is. Renaming it would change the adapter digest." + } + }, + "mint_destroy_capability_interface": { + "answer": "mint: yes. destroy: not with the lane as built. Platform will add it as RPF-1.3-T3. Until then, created-only rollback of a mint goes to owner reconciliation (UNCERTAIN). It is never silently skipped.", + "mint": "mint(path) can be bound. The Platform binding closes over the case bytes the adapter already pinned (admitted.pins.case) and derives --case-file and --case-ref @sha256: from them, so the broker re-verifies the same case. Blocker: the broker pins CASE_TYPE = 'oidc-browser-relying-party@1.1' and refuses any other case type with case_type_mismatch, so a 1.3 case is refused today (RPF-1.3-T1).", + "destroy": "The grant token is create-only by design (CCR-2026-0040: no update, delete or metadata write), and the issuer session cannot touch KV. So nothing in the lane can destroy. Exactly the minted version, for a CAS-0 first-generation entry, means: metadata read shows current_version 1, version 1's created_time equals the mint receipt's, and there are no other versions. Then delete the metadata, which removes version 1 and the entry and also reverses client-secret-path, as the type's rollback says. KV 'destroy' of version 1 alone would leave metadata, and a re-run would then hit already_present. A standing delete grant on keycape/+ would let the caller delete any KeyCape client's secret, so Platform will not issue one. Instead, destroy runs under an attended platform-admin login (the warden access openbao-platform-admin-login path used for the 2026-10-10 probe cleanup) with that compare-before-delete precondition, and returns {operation: destroy, version: 1, created: false, values_emitted: false}.", + "consequence_for_the_kernel": "A rollback that dispatches destroy inside the caller's aal2 session works only if that session also holds the attended platform-admin login. Otherwise destroy raises and the kernel records UNCERTAIN for owner reconciliation. Platform accepts that as the contract for 1.3 (carried item 6 below)." + }, + "question_2_mint_semantics": { + "decided_with": "net-kingdom", + "answer": "Consistent. Keep warden_executes true, attended false. This agrees with the net-kingdom answer.", + "reasons": [ + "That is the semantics recorded when the lane was built (RPF-WP-0054-T01, ops-warden 23985370). Warden runs credential.py generate as a child process in the caller's environment and holds no token or grant. The caller's own OIDC session (net-kingdom-admins, aal2, CCR-2026-0043) is the acting identity. Agents (WARDEN_AGENT_ID) and root are refused by the broker as well as by Executor.admit for effect mint.", + "The step is not attended. No operator handles a value, so attended plus generated_in_custody would be wrong, and the validators refuse it. Descriptor actor human is the machine form of 'a human aal2 caller starts it'.", + "The broker lane accepts a Warden-proxied call under the caller's aal2 token as written in its ops-warden catalog entry (auth_method: bao login ... role=credential-broker-keycape-client-secret-generate; broker mints a 5m create-only grant token; agents and root refused). Platform confirms this for net-kingdom's deferral." + ], + "drift_to_fix": "credential-grants/catalog.yaml keycape/client-secret-generate still lists actors.allowed_types [approved-agent, human-operator] and required_subject_binding keycape-or-kubernetes-service-account. That contradicts the issuer binding and the broker's agent refusal. The effective control (CCR-2026-0043 binding plus the broker's refusal) is correct, but the catalog must say human-operator only (RPF-1.3-T2)." + }, + "lane_platform-secret-delivery": { + "answer": "Not a real Platform lane today. No existing lane fits, so Platform will make platform-secret-delivery a real Platform lane rather than move deliver-secret to an existing one.", + "reasons": [ + "ops-warden a45cf47 has no catalog entry platform-secret-delivery. Its ESO entries (core-hub forgejo-source, issue-core, activity-core and others) are per-workload runtime pointers whose consumer is ESO itself. They are not lanes through which a human session creates an ExternalSecret. keycape-client-secret-generate is a mint lane whose grant cannot write Kubernetes objects.", + "The type's auth 'ESO delivery through role external-secrets-keycape-{client_id}' names how ESO reads custody (the materialized eso-role, bound to external-secrets/external-secrets as in CCR-2026-0041). It does not name the authority that creates ExternalSecret sso/keycape--client. That gap is real whatever the lane is called.", + "Executor.admit requires verified caller-session:human:: evidence and lane == descriptor.lane. So the lane must exist as an authenticated session lane, not just a label. Keeping the name avoids changing the descriptor digest." + ], + "lane_definition_platform_will_propose": "owner railiance-platform; human operator, aal2, net-kingdom-admins (same binding as the mint lane); contained Kubernetes authority limited to create, get, watch and delete on externalsecrets.external-secrets.io named keycape--client in namespace sso; no get or list on secrets; parent session revoked per attempt; the ESO store is a fixed Platform constant derived from client_id, never caller input. Catalog routing acceptance is ops-warden's." + } + }, + "required_changes_to_1_3_candidate": [ + { + "id": "RPF-1.3-C1", + "applies_to": "type.yaml follow_through step deliver-secret (part of the NK-1.3-C1 re-freeze; text only)", + "change": "Add lane: platform-secret-delivery. Today the step has no lane, and the composition records type_lane null. Reword auth so it names that lane and the human aal2 session inside which Warden's kernel dispatches the reviewed adapter: Platform's deliver capability applies the ExternalSecret, and ESO then reads custody through role external-secrets-keycape-{client_id}. Name the ESO store in entry_point. Settle warden_executes/attended for this step under the NK-1.3-C1/C2 rule: not attended, because no operator handles a value. Keep value_handling none and the ready_check.", + "effect_on_digests": "type.yaml only. No descriptor encodes the type (r4 O6), so both Platform descriptor digests are unchanged." + }, + { + "id": "RPF-1.3-C2", + "applies_to": "type.yaml follow_through step mint-secret (text only, same re-freeze)", + "change": "Wording only, as net-kingdom proposed: 'a human caller (net-kingdom-admins, aal2) starts it; Warden runs it unattended through the broker lane under the caller's session'. No change to warden_executes, attended, lane or value_handling.", + "effect_on_digests": "type.yaml only" + } + ], + "platform_tasks_before_owner_descriptor_acceptance": [ + { + "id": "RPF-1.3-T1", + "task": "Broker case-type acceptance. Today keycape_client_secret_generate.py refuses everything except oidc-browser-relying-party@1.1. Change it to accept an explicit set of acknowledged revisions (1.1 plus 1.3 once acknowledged), and refuse unacknowledged ones. Tests for both." + }, + { + "id": "RPF-1.3-T2", + "task": "Fix the catalog drift: keycape/client-secret-generate actors become human-operator only, with the subject binding naming the netkingdom OIDC issuer role." + }, + { + "id": "RPF-1.3-T3", + "task": "Real capability bindings for mint-secret. mint: generator plus projection to custody-mint.v1. destroy: attended platform-admin, compare-before-delete on CAS-0 version 1 with created_time equality. revoke_grant: identifier backed by the generator's grant revocation; the receipt also records the grant token accessor (not secret) so revocation can be checked independently. revoke_session: issuer-session revoke-self. publish/authenticate: Platform evidence store. Offline tests against the frozen adapter." + }, + { + "id": "RPF-1.3-T4", + "task": "Define the platform-secret-delivery lane (definition above). Build the deliver/remove capabilities producing netkingdom.deliver-secret.v1, with the implementation obligations listed under deliver-secret. Hand the catalog entry to ops-warden." + }, + { + "note": "These belong in a new Platform workplan (RPF-WP-NNNN, origin NK-WP-0048-T16). This session is limited to this file and opens none." + } + ], + "carried_items": { + "1_composer_vs_kernel_admission_fixture_only": "accept as a known limit. Real admission depends on ops-warden's native evidence trust.", + "2_import_time_vs_build_time_drift": "accept as a known limit. Both Platform adapters load no helper modules at import (SOURCE_FILES is the adapter alone) and re-check source_digest on every attempt.", + "3_version_selection_by_case_pin": "accept as a known limit for both adapters, with one condition. Platform's broker checks the case type itself (RPF-1.3-T1), which gives an independent version check for mint-secret. deliver-secret relies on the case pin plus the acknowledged type's map.", + "4_closure_test_import_time_only": "accept as a known limit", + "5_injected_stand_ins": "turned into tasks RPF-1.3-T3 and T4. No real Platform implementation of any capability has been reviewed, and none exists today for deliver/remove or destroy.", + "6_mint_then_revocation_failure_uncertain": "accept as a known limit, owned by Platform. If the mint succeeds and a revocation fails, the case-created entry and the unrevoked credential go to Platform reconciliation. The grant token expires in 5m and cannot read or update. The issuer session expires in 15m and can only mint further create-only tokens. Reconciliation follows CCR-2026-0043 lifecycle.compromised (revoke by accessor, review keycape/ metadata for entries without an accepted case). The same applies when destroy is unavailable inside the caller's session." + }, + "re_freeze_required": true, + "re_freeze_scope": "type.yaml text only (RPF-1.3-C1 and C2, folded into net-kingdom's NK-1.3-C1). Both Platform descriptor digests are unchanged, unless ops-warden refuses the lane name platform-secret-delivery.", + "grants": "none. This is an owner verdict only. It records no owner-descriptor-acceptance evidence, acknowledgment, pin, catalog entry or native authority.", + "hard_limits_observed": "source only; no live or native action; no kubectl, SSH, OpenBao or secret access; net-kingdom and ops-warden not edited (read through git archive into scratch); no hub writes; only this file written" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/apply_refinement.py b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/apply_refinement.py new file mode 100644 index 00000000..d9206c2e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/apply_refinement.py @@ -0,0 +1,68 @@ +"""Record proved compatibility findings and the real remaining owner work.""" +from pathlib import Path +import hashlib +import json +import re +import subprocess +import sys + +HERE = Path(__file__).resolve().parent +ROOT = Path('/home/worsch/net-kingdom') +PLAN = 'workplans/NK-WP-0048-security-case-types.md' +BASE = '201e2fa0f9c8398187e60983782d4aea31da19ea' + + +def sha(raw): + return hashlib.sha256(raw).hexdigest() + + +def git(*args): + return subprocess.check_output(['git', '-C', str(ROOT), *args], + stderr=subprocess.PIPE, timeout=40).decode().strip() + + +assert git('rev-parse', 'HEAD') == BASE +assert git('ls-remote', 'origin', 'refs/heads/main').split()[0] == BASE +apps_projection = json.loads((HERE.parent / 'apps-release-source-integration-r1/projection.json').read_text()) +assert apps_projection['ok'] and apps_projection['status'] == 'applied' +assert apps_projection['commit'] == apps_projection['receipt']['expected_commit'] == apps_projection['receipt']['derived_commit'] == 'c29408ae6747158a639dc876e6d7492680675658' +assert (apps_projection['receipt']['instance_role'], apps_projection['receipt']['instance_label']) == ('primary', 'railiance01') +before = (ROOT / PLAN).read_bytes() +assert sha(before) == '49f2e870bf1ba662990fa404a62d07fc72d698a6a1bcf4d5bbbe71e4c31cfec0' +blocks = re.findall(rb'```task\n.*?```', before, re.S) +assert len(blocks) == 39 +assert all(('id: NK-WP-0048-T'+str(n)).encode() not in before for n in range(40,44)) +dirty = set(git('diff', '--name-only').splitlines() + git('diff', '--cached', '--name-only').splitlines()) +assert dirty == {'.custodian-brief.md', 'WORK-RECORDS.md'} +originals = {p: {'worktree': sha((ROOT / p).read_bytes()), 'index': git('ls-files', '--stage', '--', p)} for p in dirty} +sys.path.insert(0, '/home/worsch/repo-manager/src') +from repo_manager.identifiers import ensure_missing_work_record_identifiers +preview = ensure_missing_work_record_identifiers(ROOT, execute=False) +assert preview['ok'] and not preview['assignments'] and not preview['files_changed'] +(ROOT / PLAN).write_bytes(before + (HERE / 'task-additions.md').read_bytes()) +preview = ensure_missing_work_record_identifiers(ROOT, execute=False) +(HERE / 'identifier-preview.json').write_text(json.dumps(preview, indent=2) + '\n') +assert preview['ok'] and preview['files_changed'] == [PLAN] +assert {r['record_id'] for r in preview['assignments']} == {'NK-WP-0048-T40', 'NK-WP-0048-T41', 'NK-WP-0048-T42', 'NK-WP-0048-T43'} +assigned = ensure_missing_work_record_identifiers(ROOT, execute=True) +(HERE / 'identifier-assignment.json').write_text(json.dumps(assigned, indent=2) + '\n') +after = (ROOT / PLAN).read_bytes() +assert re.findall(rb'```task\n.*?```', after, re.S)[:39] == blocks +assert len(re.findall(rb'```task\n.*?```', after, re.S)) == 43 +for p, old in originals.items(): + assert sha((ROOT / p).read_bytes()) == old['worktree'] + assert git('ls-files', '--stage', '--', p) == old['index'] +files = [{'path': PLAN, 'sha256': sha(after)}] +(HERE / 'publication-inputs.json').write_text(json.dumps({ + 'owner': 'net-kingdom', 'base_revision': BASE, + 'message': 'Record published consumer build and refine private input inverse and PDP work', + 'files': files}, indent=2) + '\n') +(HERE / 'source-refinement.json').write_text(json.dumps({ + 'base': BASE, 'files': files, 'original_task_blocks_preserved': 39, + 'source_task_count': 43, 'new_tasks': {'NK-WP-0048-T40': 'done', 'NK-WP-0048-T41': 'progress', 'NK-WP-0048-T42': 'progress', 'NK-WP-0048-T43': 'progress'}, + 'unrelated_state': originals, 'new_ids': assigned['assignments'], + 'knowledge': {'version': '0.2.6', 'digest': 'sha256:8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02', + 'status': 'withheld/orientation-only; actual INTENT and SECURITY-COMPANION reviewed'}, + 'native_or_credential_actions': False}, indent=2) + '\n') +print(json.dumps({'status': 'source_refined', 'original_task_blocks_preserved': 39, + 'source_task_count': 43, 'normal_allocator_assignments': len(assigned['assignments'])})) diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/consistency.json b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/consistency.json new file mode 100644 index 00000000..a15f0826 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/consistency.json @@ -0,0 +1,387 @@ +{ + "repo_slug": "net-kingdom", + "repo_path": "/home/worsch/net-kingdom", + "source_revision": "b3f31d9f26b98a3b92690e0be34a205e49fa3956", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-24", + "message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['NET-WP', 'NK-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0011' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0011-enterprise-federation-saml.md", + "db_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub", + "file_path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md", + "db_id": "", + "file_value": "USER-WP-0020", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0004' is not linked to State Hub", + "file_path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md", + "db_id": "", + "file_value": "KEY-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub", + "file_path": "workplans/NK-WP-0023-user-engine-portal-platform-integration.md", + "db_id": "", + "file_value": "USER-WP-0020", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0004' is not linked to State Hub", + "file_path": "workplans/NK-WP-0023-user-engine-portal-platform-integration.md", + "db_id": "", + "file_value": "KEY-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0021' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "USER-WP-0021", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'FLEX-WP-0009' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "FLEX-WP-0009", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'AUDIT-WP-0003' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "AUDIT-WP-0003", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'EMAIL-WP-0004' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "EMAIL-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0022' is not linked to State Hub", + "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md", + "db_id": "", + "file_value": "USER-WP-0022", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0008' is not linked to State Hub", + "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md", + "db_id": "", + "file_value": "KEY-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'CSOC-WP-0003' is not linked to State Hub", + "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md", + "db_id": "", + "file_value": "CSOC-WP-0003", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0027' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0027-reef-placement-reconciliation.md", + "db_id": "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0031' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0031-deterministic-posture-feedback.md", + "db_id": "9d7b04f9-3803-5613-b7a5-8bd606c77f5a", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0040' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0040-execution-attribution-receipt.md", + "db_id": "e2533f3a-aa43-59b3-bff3-8e64b6149487", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'NK-WP-0048-T15' in workplan 'NK-WP-0048' \u2014 every depends_on target is terminal (NK-WP-0048-T31)", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T15", + "db_id": "", + "file_value": "NK-WP-0048-T31", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'NK-WP-0048-T40' is absent from this projection", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T40", + "db_id": "7cc93671-fe94-5108-a486-1b0029e69487", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Missing DB dependency edge: task 'NK-WP-0048-T41' starts after task NK-WP-0048-T38", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T41", + "db_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "file_value": "NK-WP-0048-T38", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'NK-WP-0048-T41' is absent from this projection", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T41", + "db_id": "6edf049f-2c52-5040-8d38-0bb1bc78fa31", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'NK-WP-0048-T42' is absent from this projection", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T42", + "db_id": "3d1b9128-bade-5bd9-8660-22a14eea2d37", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'NK-WP-0048-T43' is absent from this projection", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T43", + "db_id": "ac77b046-1226-5e5a-a212-512cb4fdc484", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAIL-PL-WP-0002' is not linked to State Hub", + "file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0002", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'nk-wp-0035@retired-20260908' (id=064c5e8b\u2026, status=archived) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "064c5e8b-7852-4d7f-a5fa-e26e406ab8e0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-08-14@retired-20260827' (id=a5097121\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "a5097121-1461-59f8-81fa-e6ecef527337", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-08-23@retired-20260827' (id=e25ba5fa\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "e25ba5fa-eaae-5039-8d93-a69c6d837fc4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'net-kingdom-adhoc-2026-07-02@retired-20260827' (id=67c1c7ac\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "67c1c7ac-d8b1-41dc-a81a-4e43f1afd068", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'net-kingdom-adhoc-2026-06-14@retired-20260827' (id=c6f3d6bf\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "c6f3d6bf-4916-490d-96ce-092d2776d7e7", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0020' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md", + "db_id": "", + "file_value": "NET-WP-0020", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0015' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260603-NET-WP-0015-platform-root-custody-and-openbao-identity-bootstrap.md", + "db_id": "", + "file_value": "NET-WP-0015", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0016' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260603-NET-WP-0016-guided-security-bootstrap-experience.md", + "db_id": "", + "file_value": "NET-WP-0016", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0018' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260604-NET-WP-0018-bootstrap-automation-and-rebuild-readiness.md", + "db_id": "", + "file_value": "NET-WP-0018", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0017' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md", + "db_id": "", + "file_value": "NET-WP-0017", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0019' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-NET-WP-0019-t06-adjacent-user-lifecycle-dry-run-polish.md", + "db_id": "", + "file_value": "NET-WP-0019", + "db_value": "NK-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 64/64", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-33 fixed: regenerated WORK-RECORDS.md", + "C-11 fixed: task 'NK-WP-0048-T40' \u2192 7cc93671\u2026", + "C-20 FAILED: 404 Not Found: {\"detail\":\"from task not found in this workplan\"}", + "C-11 fixed: task 'NK-WP-0048-T41' \u2192 6edf049f\u2026", + "C-11 fixed: task 'NK-WP-0048-T42' \u2192 3d1b9128\u2026", + "C-11 fixed: task 'NK-WP-0048-T43' \u2192 ac77b046\u2026", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 31, + "info": 5 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/consistency.stderr.txt new file mode 100644 index 00000000..3345563f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/consistency.stderr.txt @@ -0,0 +1 @@ +WARN: git commit failed for writeback: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/identifier-assignment.json b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/identifier-assignment.json new file mode 100644 index 00000000..18ed9b09 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/identifier-assignment.json @@ -0,0 +1,38 @@ +{ + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "net-kingdom", + "namespace": "helixforge", + "assignments": [ + { + "kind": "task", + "record_id": "NK-WP-0048-T40", + "uuid": "7cc93671-fe94-5108-a486-1b0029e69487", + "path": "workplans/NK-WP-0048-security-case-types.md" + }, + { + "kind": "task", + "record_id": "NK-WP-0048-T41", + "uuid": "6edf049f-2c52-5040-8d38-0bb1bc78fa31", + "path": "workplans/NK-WP-0048-security-case-types.md" + }, + { + "kind": "task", + "record_id": "NK-WP-0048-T42", + "uuid": "3d1b9128-bade-5bd9-8660-22a14eea2d37", + "path": "workplans/NK-WP-0048-security-case-types.md" + }, + { + "kind": "task", + "record_id": "NK-WP-0048-T43", + "uuid": "ac77b046-1226-5e5a-a212-512cb4fdc484", + "path": "workplans/NK-WP-0048-security-case-types.md" + } + ], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [ + "workplans/NK-WP-0048-security-case-types.md" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/identifier-preview.json b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/identifier-preview.json new file mode 100644 index 00000000..3d065a8d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/identifier-preview.json @@ -0,0 +1,38 @@ +{ + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": false, + "repo": "net-kingdom", + "namespace": "helixforge", + "assignments": [ + { + "kind": "task", + "record_id": "NK-WP-0048-T40", + "uuid": "7cc93671-fe94-5108-a486-1b0029e69487", + "path": "workplans/NK-WP-0048-security-case-types.md" + }, + { + "kind": "task", + "record_id": "NK-WP-0048-T41", + "uuid": "6edf049f-2c52-5040-8d38-0bb1bc78fa31", + "path": "workplans/NK-WP-0048-security-case-types.md" + }, + { + "kind": "task", + "record_id": "NK-WP-0048-T42", + "uuid": "3d1b9128-bade-5bd9-8660-22a14eea2d37", + "path": "workplans/NK-WP-0048-security-case-types.md" + }, + { + "kind": "task", + "record_id": "NK-WP-0048-T43", + "uuid": "ac77b046-1226-5e5a-a212-512cb4fdc484", + "path": "workplans/NK-WP-0048-security-case-types.md" + } + ], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [ + "workplans/NK-WP-0048-security-case-types.md" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/orientation.json b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/orientation.json new file mode 100644 index 00000000..31e70625 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/orientation.json @@ -0,0 +1,8 @@ +{ + "package_version": "0.2.6", + "package_digest": "sha256:8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "status": "withheld/orientation-only", + "actual_INTENT_and_SECURITY_COMPANION_reviewed": true, + "first_attempt": "ModuleNotFoundError before explicit sibling source path; no source or authority changed", + "native_actions": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/projection.json b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/projection.json new file mode 100644 index 00000000..cf09ee1e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/projection.json @@ -0,0 +1,1003 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "net-kingdom", + "commit": "b3f31d9f26b98a3b92690e0be34a205e49fa3956", + "requests": 2, + "elapsed_ms": 11662.7, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "net-kingdom", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "b3f31d9f26b98a3b92690e0be34a205e49fa3956", + "derived_commit": "b3f31d9f26b98a3b92690e0be34a205e49fa3956", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "net-kingdom", + "commit": "b3f31d9f26b98a3b92690e0be34a205e49fa3956", + "status": "applied", + "counts": { + "created": 0, + "updated": 64, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 4, + "cancelled_tasks": 0, + "created_edges": 1, + "removed_edges": 0, + "unresolved_edges": 1, + "external_edges": 85 + }, + "created": [], + "updated": [ + "NET-WP-0015", + "NET-WP-0016", + "NET-WP-0017", + "NET-WP-0018", + "NET-WP-0019", + "NET-WP-0020", + "NK-WP-0001", + "NK-WP-0002", + "NK-WP-0003", + "NK-WP-0004", + "NK-WP-0005", + "NK-WP-0006", + "NK-WP-0007", + "NK-WP-0008", + "NK-WP-0009", + "NK-WP-0010", + "NK-WP-0011", + "NK-WP-0012", + "NK-WP-0013", + "NK-WP-0014", + "NK-WP-0015", + "NK-WP-0016", + "NK-WP-0017", + "NK-WP-0018", + "NK-WP-0019", + "NK-WP-0021", + "NK-WP-0022", + "NK-WP-0023", + "NK-WP-0024", + "NK-WP-0025", + "NK-WP-0026", + "NK-WP-0027", + "NK-WP-0028", + "NK-WP-0029", + "NK-WP-0030", + "NK-WP-0031", + "NK-WP-0032", + "NK-WP-0033", + "NK-WP-0034", + "NK-WP-0035", + "NK-WP-0036", + "NK-WP-0037", + "NK-WP-0038", + "NK-WP-0039", + "NK-WP-0040", + "NK-WP-0041", + "NK-WP-0042", + "NK-WP-0043", + "NK-WP-0044", + "NK-WP-0045", + "NK-WP-0046", + "NK-WP-0047", + "NK-WP-0048", + "NK-WP-0049", + "NK-WP-0050", + "NK-WP-0051", + "NK-WP-ADHOC-2026-06-14", + "NK-WP-ADHOC-2026-07-02", + "NK-WP-ADHOC-2026-08-14", + "NK-WP-ADHOC-2026-08-23", + "NK-WP-ADHOC-2026-10-03", + "NK-WP-ADHOC-2026-10-10", + "NK-WP-ADHOC-2026-10-11", + "NK-WP-ADHOC-2026-10-16" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [ + "NK-WP-0048-T40", + "NK-WP-0048-T41", + "NK-WP-0048-T42", + "NK-WP-0048-T43" + ], + "cancelled_tasks": [], + "created_edges": [ + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T41", + "target": "NK-WP-0048-T38", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "6edf049f-2c52-5040-8d38-0bb1bc78fa31", + "to_workplan_id": null, + "to_task_id": "2c32b963-a87c-50a1-91e1-b07ea1fe4960" + } + ], + "removed_edges": [], + "unresolved_edges": [ + { + "workplan": "NK-WP-0006", + "from": "NK-WP-0006", + "target": "NK-WP-0001", + "reason": "missing" + } + ], + "external_edges": [ + { + "workplan": "NK-WP-0008", + "from": "NK-WP-0008", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0050", + "from": "NK-WP-0050-T03", + "target": "RPF-WP-0056-T03", + "relationship_type": "starts_after", + "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377", + "from_task_id": "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e", + "to_workplan_id": null, + "to_task_id": "a82762eb-bb6d-5600-89ca-a81ada2eba9f" + }, + { + "workplan": "NK-WP-0050", + "from": "NK-WP-0050-T03", + "target": "NK-WP-0050-T02", + "relationship_type": "starts_after", + "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377", + "from_task_id": "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e", + "to_workplan_id": null, + "to_task_id": "a9dadd07-f136-5dc7-9229-7a9dbb941f0d" + }, + { + "workplan": "NK-WP-0050", + "from": "NK-WP-0050-T02", + "target": "NK-WP-0050-T01", + "relationship_type": "starts_after", + "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377", + "from_task_id": "a9dadd07-f136-5dc7-9229-7a9dbb941f0d", + "to_workplan_id": null, + "to_task_id": "64893d94-9717-5812-b8e3-7cabe095fcdc" + }, + { + "workplan": "NK-WP-0017", + "from": "NK-WP-0017", + "target": "NK-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "08398d26-cadf-44bc-97ee-67da790040e6", + "from_task_id": null, + "to_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011", + "target": "NK-WP-0003", + "relationship_type": "blocks", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": null, + "to_workplan_id": "f24cefd4-a09b-4fa1-9b25-94bf783b425e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T03", + "target": "NK-WP-0011-T02", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908", + "to_workplan_id": null, + "to_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T07", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T07", + "target": "NK-WP-0011-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833", + "to_workplan_id": null, + "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T07", + "target": "NK-WP-0011-T05", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833", + "to_workplan_id": null, + "to_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T04", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T06", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T06", + "target": "NK-WP-0011-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446", + "to_workplan_id": null, + "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T06", + "target": "NK-WP-0011-T05", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446", + "to_workplan_id": null, + "to_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T05", + "target": "NK-WP-0011-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d", + "to_workplan_id": null, + "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T09", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T09", + "target": "NK-WP-0011-T07", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e", + "to_workplan_id": null, + "to_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T09", + "target": "NK-WP-0011-T08", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e", + "to_workplan_id": null, + "to_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T08", + "target": "NK-WP-0011-T02", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d", + "to_workplan_id": null, + "to_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T08", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NET-WP-0016", + "from": "NET-WP-0016", + "target": "NET-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38", + "from_task_id": null, + "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "to_task_id": null + }, + { + "workplan": "NET-WP-0016", + "from": "NET-WP-0016", + "target": "NK-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38", + "from_task_id": null, + "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "to_task_id": null + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T18", + "target": "NK-WP-0049-T33", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "141dd773-c1fa-56c1-a852-bbe2372e5125", + "to_workplan_id": null, + "to_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T18", + "target": "NK-WP-0049-T32", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "141dd773-c1fa-56c1-a852-bbe2372e5125", + "to_workplan_id": null, + "to_task_id": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T35", + "target": "NK-WP-0049-T34", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "1bfd1703-589f-5511-bad5-812d860e4a71", + "to_workplan_id": null, + "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T35", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "1bfd1703-589f-5511-bad5-812d860e4a71" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T34", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T36", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "8b72334b-fc27-5707-a189-bad345eaf3bc" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T32", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T36", + "target": "NK-WP-0049-T34", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "8b72334b-fc27-5707-a189-bad345eaf3bc", + "to_workplan_id": null, + "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T03", + "target": "NK-WP-0049-T02", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac", + "to_workplan_id": null, + "to_task_id": "479d6970-6516-50f5-9436-bb5b56d58aad" + }, + { + "workplan": "NK-WP-0025", + "from": "NK-WP-0025", + "target": "NK-WP-0024", + "relationship_type": "blocks", + "from_workplan_id": "2412a251-d6b5-5f05-8082-3eb7697c51dc", + "from_task_id": null, + "to_workplan_id": "635a73d4-b3cb-5c38-af22-56a6a66beb0e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0016", + "from": "NK-WP-0016", + "target": "NK-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "2d592e18-e63d-4856-97a1-f8c3e019e150", + "from_task_id": null, + "to_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8", + "to_task_id": null + }, + { + "workplan": "NK-WP-0006", + "from": "NK-WP-0006", + "target": "NK-WP-0005", + "relationship_type": "blocks", + "from_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "from_task_id": null, + "to_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19", + "to_task_id": null + }, + { + "workplan": "NK-WP-0006", + "from": "NK-WP-0006", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0013", + "from": "NK-WP-0013", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "32a54d8e-8633-42a6-8ec1-104842c581c1", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0015", + "from": "NK-WP-0015", + "target": "NK-WP-0014", + "relationship_type": "blocks", + "from_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8", + "from_task_id": null, + "to_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c", + "to_task_id": null + }, + { + "workplan": "NET-WP-0017", + "from": "NET-WP-0017", + "target": "NET-WP-0016", + "relationship_type": "blocks", + "from_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "from_task_id": null, + "to_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38", + "to_task_id": null + }, + { + "workplan": "NET-WP-0017", + "from": "NET-WP-0017", + "target": "NET-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "from_task_id": null, + "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "to_task_id": null + }, + { + "workplan": "NK-WP-0007", + "from": "NK-WP-0007", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0007", + "from": "NK-WP-0007", + "target": "NK-WP-0005", + "relationship_type": "blocks", + "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695", + "from_task_id": null, + "to_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19", + "to_task_id": null + }, + { + "workplan": "NK-WP-0007", + "from": "NK-WP-0007", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0024", + "from": "NK-WP-0024", + "target": "NK-WP-0023", + "relationship_type": "blocks", + "from_workplan_id": "635a73d4-b3cb-5c38-af22-56a6a66beb0e", + "from_task_id": null, + "to_workplan_id": "fdb3deee-06c3-5d12-91ce-9c50b2ac0618", + "to_task_id": null + }, + { + "workplan": "NET-WP-0015", + "from": "NET-WP-0015", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NET-WP-0015", + "from": "NET-WP-0015", + "target": "NK-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "from_task_id": null, + "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "to_task_id": null + }, + { + "workplan": "NK-WP-0018", + "from": "NK-WP-0018", + "target": "NK-WP-0017", + "relationship_type": "blocks", + "from_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87", + "from_task_id": null, + "to_workplan_id": "08398d26-cadf-44bc-97ee-67da790040e6", + "to_task_id": null + }, + { + "workplan": "NK-WP-0018", + "from": "NK-WP-0018", + "target": "NK-WP-0016", + "relationship_type": "blocks", + "from_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87", + "from_task_id": null, + "to_workplan_id": "2d592e18-e63d-4856-97a1-f8c3e019e150", + "to_task_id": null + }, + { + "workplan": "NK-WP-0005", + "from": "NK-WP-0005", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NET-WP-0019", + "from": "NET-WP-0019", + "target": "NET-WP-0017", + "relationship_type": "blocks", + "from_workplan_id": "75d388b6-7ec1-4e1b-8c87-6ff44f953210", + "from_task_id": null, + "to_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "to_task_id": null + }, + { + "workplan": "NET-WP-0019", + "from": "NET-WP-0019", + "target": "NET-WP-0018", + "relationship_type": "blocks", + "from_workplan_id": "75d388b6-7ec1-4e1b-8c87-6ff44f953210", + "from_task_id": null, + "to_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698", + "to_task_id": null + }, + { + "workplan": "NET-WP-0018", + "from": "NET-WP-0018", + "target": "NET-WP-0017", + "relationship_type": "blocks", + "from_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698", + "from_task_id": null, + "to_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "to_task_id": null + }, + { + "workplan": "NET-WP-0018", + "from": "NET-WP-0018", + "target": "NET-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698", + "from_task_id": null, + "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "to_task_id": null + }, + { + "workplan": "NK-WP-0027", + "from": "NK-WP-0027-T03", + "target": "NK-WP-0027-T02", + "relationship_type": "starts_after", + "from_workplan_id": "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4", + "from_task_id": "e3f0bb0f-0c85-5cb9-a5ab-75f668cd3447", + "to_workplan_id": null, + "to_task_id": "5b35b646-a525-55da-852a-6005613d42ea" + }, + { + "workplan": "NK-WP-0012", + "from": "NK-WP-0012", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0014", + "from": "NK-WP-0014", + "target": "NK-WP-0013", + "relationship_type": "blocks", + "from_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c", + "from_task_id": null, + "to_workplan_id": "32a54d8e-8633-42a6-8ec1-104842c581c1", + "to_task_id": null + }, + { + "workplan": "NK-WP-0014", + "from": "NK-WP-0014", + "target": "NK-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c", + "from_task_id": null, + "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "to_task_id": null + }, + { + "workplan": "NK-WP-0019", + "from": "NK-WP-0019", + "target": "NK-WP-0018", + "relationship_type": "blocks", + "from_workplan_id": "d2daa8b4-8ecf-4377-b382-492e653735f7", + "from_task_id": null, + "to_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87", + "to_task_id": null + }, + { + "workplan": "NK-WP-0009", + "from": "NK-WP-0009", + "target": "NK-WP-0008", + "relationship_type": "blocks", + "from_workplan_id": "d4d02dbf-3974-502d-8b87-b776fc63e17e", + "from_task_id": null, + "to_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d", + "to_task_id": null + }, + { + "workplan": "NK-WP-0022", + "from": "NK-WP-0022", + "target": "NK-WP-0023", + "relationship_type": "blocks", + "from_workplan_id": "d76ddccc-00c8-548a-b141-2cd660fa38da", + "from_task_id": null, + "to_workplan_id": "fdb3deee-06c3-5d12-91ce-9c50b2ac0618", + "to_task_id": null + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T15", + "target": "NK-WP-0048-T31", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "1b825705-4848-5edc-832f-b1622cd9bdb7", + "to_workplan_id": null, + "to_task_id": "ed1ccd87-89a0-5e69-885c-0eaf5ab0bb5a" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T25", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "0de2a7d9-874d-578b-a076-f653fe42e30b" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T29", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "129db41d-4560-5e20-9f3b-c3c91e0a5601" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T24", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "1a3931ee-3b5f-52fc-9295-4073804f4bd2" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T28", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "6dab281c-ea9a-5a17-a83f-e8e9a4d4484f" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T30", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "6f6073ac-52dd-5b70-8874-6d76d4c072e4" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T26", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "94b3cbf0-c908-5ac6-b0db-67385c3e021c" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T27", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "e56365f8-29b5-5c89-a329-8115f9f3b2a7" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T07", + "target": "NK-WP-0048-T06", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "c3c9c3ae-4f23-5ba7-9e6f-e63bcf29b9f7", + "to_workplan_id": null, + "to_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T09", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "0ee12dfc-8260-5038-bd39-cc7fb4113be0" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T15", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "1b825705-4848-5edc-832f-b1622cd9bdb7" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T16", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T05", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "3d987d3d-0797-538b-86e4-51185a327ae2" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "MASON-WP-0010-T03", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "56cea6be-c613-586c-80cd-125340b374da" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T12", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "7ce4eee3-cd47-55a9-bfa5-4f1835d4d6fd" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T20", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T17", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "8c3e4baa-a218-5996-af9e-fe1153a46dac" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T08", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "8e519082-dc8b-5e46-b660-03d03e55dcf6" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T18", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "9c45da71-fb4c-5f20-9065-90f448f37c64" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T13", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "b264c10b-565c-5d29-b788-03cf5fbd2883" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "WARDEN-WP-0044-T03", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T14", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "fce95440-a25b-5f27-8ef3-a3d182099113" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T14", + "target": "NK-WP-0048-T20", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "fce95440-a25b-5f27-8ef3-a3d182099113", + "to_workplan_id": null, + "to_task_id": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8" + }, + { + "workplan": "NK-WP-0010", + "from": "NK-WP-0010", + "target": "NK-WP-0008", + "relationship_type": "blocks", + "from_workplan_id": "f4faf8b4-ae57-40cf-a881-6fe66ca6ad74", + "from_task_id": null, + "to_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d", + "to_task_id": null + } + ], + "refused": [], + "notes": [] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-backup/.custodian-brief.md.worktree new file mode 100644 index 00000000..ccdbe126 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-backup/.custodian-brief.md.worktree @@ -0,0 +1,91 @@ + +# Custodian Brief — net-kingdom + +**Domain:** infotech +**Last synced:** 2026-10-17 09:16 UTC +**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + +## Active Workstreams + +### Publish the NetKingdom emission-cadence security profile +Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc` + +**Open tasks:** +- ► Bind and hand off the published contract `e3fbc8b8` + +### Register Playwright human and agent consumers through governed identity delivery +Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377` + +**Open tasks:** +- ! Verify issuer and real consumer acceptance `5a3aaf57` + *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)* +- ► Deliver custody integration and guarded registration activation `a9dadd07` + +### Remove bootstrap secret output and verify separated recovery custody +Progress: 26/38 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804` + +**Open tasks:** +- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3` + *(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)* +- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00` + *(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)* +- ! Verify current caller and provider admission at their actual boundaries `77aa42be` + *(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)* +- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7` + *(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)* +- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773` + *(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)* +- ! Prove restored Authelia storage and OIDC continuity `b47f9975` + *(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)* +- ! Prepare the exact owner-held KeyCape recovery attempt `56c8d469` + *(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)* +- … and 5 more open tasks + +### Establish SecurityCaseTypes so that known security cases are light +Progress: 25/31 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb` + +**Open tasks:** +- ! T05 — Acknowledge the type through informed-decision `d9b26bcf` + *(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)* +- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae` + *(wait: The next types follow once the first one is proven end to end.)* +- ! T15 — Define authenticated recovery for lost registration process state `1b825705` + *(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)* +- ► T14 — Admit governed group rollback against native owner boundaries `fce95440` +- · T12 — Prepare NetKingdom-owned attended step adapters `7ce4eee3` +- · T16 — Select and review the actual machine descriptor composition `200bf500` + +### Define an execution-attribution receipt for Railiance runs +Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487` + +**Open tasks:** +- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1` + *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)* + +### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker +Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07` + +**Open tasks:** +- ! Admit the database consumer `2fe6f100` + *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)* +- ! Package the broker deployment `32d1411b` + *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)* +- ! Integrate an upstream identity provider `6697a994` + *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)* +- ! Define federated assurance `d845380d` + *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)* +- ! Verify IAM conformance and coexistence `9cb7fd93` + *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)* +- ! Enforce tenant and platform boundaries `38998c68` + *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)* +- ! Prove recovery and audit delivery `e5f44ddc` + *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)* +- … and 1 more open tasks + +--- +## MCP Orientation (when available) + +If the state-hub MCP server is reachable, call: +`get_domain_summary("infotech")` +This provides richer cross-domain context. +If the MCP call fails, use this file as your orientation source. diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-backup/WORK-RECORDS.md.worktree new file mode 100644 index 00000000..4eda3538 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-backup/WORK-RECORDS.md.worktree @@ -0,0 +1,289 @@ +# Work Records — net-kingdom + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md | +| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md | +| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md | +| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md | +| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md | +| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md | +| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md | +| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md | +| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md | +| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md | +| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md | +| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md | +| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | +| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | +| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | +| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md | +| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md | +| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md | +| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md | +| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md | +| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md | +| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md | +| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md | +| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md | +| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md | +| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md | +| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md | +| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | +| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | +| intake | NET-IN-0001 | open | — | intakes/intakes.md | +| intake | NET-IN-0002 | open | — | intakes/intakes.md | +| intake | NET-IN-0003 | open | — | intakes/intakes.md | +| intake | NET-IN-0004 | open | — | intakes/intakes.md | diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-backup/originals.json new file mode 100644 index 00000000..1e3b06c0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-backup/originals.json @@ -0,0 +1,10 @@ +[ + { + "path": ".custodian-brief.md", + "index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md" + }, + { + "path": "WORK-RECORDS.md", + "index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md" + } +] diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-commit.json b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-commit.json new file mode 100644 index 00000000..fdec7967 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-commit.json @@ -0,0 +1,13 @@ +{ + "exit_code": 0, + "commit": "b3f31d9f26b98a3b92690e0be34a205e49fa3956", + "base": "201e2fa0f9c8398187e60983782d4aea31da19ea", + "files": [ + { + "path": "workplans/NK-WP-0048-security-case-types.md", + "sha256": "98c975c1477ba8db90b06c1b428f80bd34e12ae282181891734b1950f3f623cb" + } + ], + "stdout": "[main b3f31d9] Record published consumer build and refine private input inverse and PDP work\n 1 file changed, 103 insertions(+)\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 1, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-inputs.json b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-inputs.json new file mode 100644 index 00000000..983ad2a1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/publication-inputs.json @@ -0,0 +1,11 @@ +{ + "owner": "net-kingdom", + "base_revision": "201e2fa0f9c8398187e60983782d4aea31da19ea", + "message": "Record published consumer build and refine private input inverse and PDP work", + "files": [ + { + "path": "workplans/NK-WP-0048-security-case-types.md", + "sha256": "98c975c1477ba8db90b06c1b428f80bd34e12ae282181891734b1950f3f623cb" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/source-refinement.json b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/source-refinement.json new file mode 100644 index 00000000..b4ed2425 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/source-refinement.json @@ -0,0 +1,59 @@ +{ + "base": "201e2fa0f9c8398187e60983782d4aea31da19ea", + "files": [ + { + "path": "workplans/NK-WP-0048-security-case-types.md", + "sha256": "98c975c1477ba8db90b06c1b428f80bd34e12ae282181891734b1950f3f623cb" + } + ], + "original_task_blocks_preserved": 39, + "source_task_count": 43, + "new_tasks": { + "NK-WP-0048-T40": "done", + "NK-WP-0048-T41": "progress", + "NK-WP-0048-T42": "progress", + "NK-WP-0048-T43": "progress" + }, + "unrelated_state": { + ".custodian-brief.md": { + "worktree": "3eb7f91f2443090c9b859a716d83711310364897b6144dcf10d3254342fec3d1", + "index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md" + }, + "WORK-RECORDS.md": { + "worktree": "a1fec217a6e380f528778d781dbea1fc5a836fdefa1dd4dd0308100fbe08112a", + "index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md" + } + }, + "new_ids": [ + { + "kind": "task", + "record_id": "NK-WP-0048-T40", + "uuid": "7cc93671-fe94-5108-a486-1b0029e69487", + "path": "workplans/NK-WP-0048-security-case-types.md" + }, + { + "kind": "task", + "record_id": "NK-WP-0048-T41", + "uuid": "6edf049f-2c52-5040-8d38-0bb1bc78fa31", + "path": "workplans/NK-WP-0048-security-case-types.md" + }, + { + "kind": "task", + "record_id": "NK-WP-0048-T42", + "uuid": "3d1b9128-bade-5bd9-8660-22a14eea2d37", + "path": "workplans/NK-WP-0048-security-case-types.md" + }, + { + "kind": "task", + "record_id": "NK-WP-0048-T43", + "uuid": "ac77b046-1226-5e5a-a212-512cb4fdc484", + "path": "workplans/NK-WP-0048-security-case-types.md" + } + ], + "knowledge": { + "version": "0.2.6", + "digest": "sha256:8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "status": "withheld/orientation-only; actual INTENT and SECURITY-COMPANION reviewed" + }, + "native_or_credential_actions": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/task-additions.md b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/task-additions.md new file mode 100644 index 00000000..891254fb --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-application-owner-refinement-r1/task-additions.md @@ -0,0 +1,99 @@ + + +## T40 — Publish the independently reviewed full consumer build path + +```task +id: NK-WP-0048-T40 +status: done +depends_on: [NK-WP-0048-T38] +priority: high +``` + +Completed 2026-10-18, release source/tooling outcome extracted from T39. +Apps RAPPS-WP-0016-T06 owns the pinned official-source/frontend/bindata/static +binary/OCI recipe. The original profile produced identical complete binaries and +local OCI archives. Independent review rehashed those artifacts, re-extracted all +2,234 embedded files and found a host process argv visibility defect through +/proc. The corrected recipe adds a private PID namespace; a synthetic unrelated +process canary is visible with r1 and denied with exact r2. Existing full builds +are historical r1-profile evidence, not an executed full r2 build claim. + +Canonical Apps source c29408ae contains the six reviewed build paths plus its +work-record refinement; the normal owner projection receipt is in Custodian +apps-release-source-integration-r1. Exact candidate patch sha256:b7ad8f8fd908532800f4e7eb0f7ad85d77e21a0b729cb5115ade3d5fe3e4acd8 +and review sha256:6f016d53a7ec9ece2f9da9686e76127c52d17066f2b3d371628832ac9537ac5c +are retained with original changes-required review and harness refinements. +No image/default values, registry publication, formal owner assent or native +acceptance changed. T39 retains integrated successor package/image provenance, +architecture/owner dispositions and bounded deployment/inverse readiness. + +## T41 — Integrate the real private-input CLI and chart revision + +```task +id: NK-WP-0048-T41 +status: progress +depends_on: [NK-WP-0048-T38] +priority: high +``` + +Owner: Apps RAPPS-WP-0016-T07. Current public-source implementation adds actual +Forgejo add/update --secret-file and adapts the exact chart helper plus fixed +CLIENT_SECRET read-only subPath reference. Next: independently review the exact +candidate, including real CLI/SQLite update preservation and refusals, descriptor +file replacement/permissions and actual Helm command/mount rendering. Preserve +legacy and three-group semantics and the current custody route/key. Custody, +mount/reader/version admission and rotation/restart remain runtime obligations; +no agent or public receipt receives the value. Re-freeze the accepted software/ +chart/type/package only after review; T06 native proof remains separate. +Evidence under Custodian forgejo-private-input-r1; do not substitute a path flag +without suppressing the chart's legacy secret argument. + +## T42 — Integrate the actual durable application-source transaction and inverse + +```task +id: NK-WP-0048-T42 +status: progress +priority: high +``` + +Owner: Apps RAPPS-WP-0016-T08; retained umbrella T34. Actual Forgejo model-layer +work compares complete raw persisted state privately and records intent/outcome +in the same DB transaction. SQLite write transactions and PostgreSQL table locks +must exclude competing DB writes; unsupported databases refuse. Tests include +real SQLite competing connections and process crash/restart. Fixed SQL-error, +slow-query and trace diagnostics must not leak private journal arguments. + +Next: independently review exact primitive/schema/logging/recovery code, then +bind it through authenticated current operation/inverse sessions and admitted +evidence/release serialization. The DB primitive itself grants no authority and +is not a complete operation backend. Its private journal introduces credential +copies in the owner's DB: track reader custody, capacity, retention and recovery; +never erase uncertainty or downgrade while a linked source prevents safe removal. +All application/Helm writers and current provider state remain T34 obligations. +Evidence under Custodian apps-operation-backend-r1; no private production DB read. + +## T43 — Bind the consumer and protected operations to the actual single PDP + +```task +id: NK-WP-0048-T43 +status: progress +priority: high +``` + +Owners: Access Engine for producer adapter/policy; Apps RAPPS-WP-0016-T09 for +consumer enforcement; retained umbrella T37. Next: implement and independently +review the producer-owned standalone Go adapter using exact pinned API/signing +source, current authenticated request/policy/registry/caller bindings and bounded +nonce/lifetime checks. The actual provider must validate issuer JWT signatures, +algorithm/audience/type/lifetime and retain a trusted identity snapshot separate +from mutable UserInfo groups/claims before calling the PDP. Do not treat decoded +Goth RawData as verified identity or let UserInfo overwrite issuer/tenant/assurance. +Any producer numeric-decoding fix needs actual producer/consumer parity tests. + +Keep the accepted three-group any-of set as PDP policy input; do not invent an +issuer verdict or allow a local compatibility gate to replace the PDP. A callback +check proves login only: actual HTTP/API/Git/SSH resource/action and session/ +revocation coverage must match the final application profile. No source adapter, +synthetic key, stale cached decision or Boolean callback constitutes authority. +Evidence under Custodian apps-access-engine-integration-r1; live source/key/caller/ +policy admission and full profile acceptance remain open under T06/T16/T37. diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/publication-backup/.custodian-brief.md.worktree new file mode 100644 index 00000000..ccdbe126 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/publication-backup/.custodian-brief.md.worktree @@ -0,0 +1,91 @@ + +# Custodian Brief — net-kingdom + +**Domain:** infotech +**Last synced:** 2026-10-17 09:16 UTC +**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + +## Active Workstreams + +### Publish the NetKingdom emission-cadence security profile +Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc` + +**Open tasks:** +- ► Bind and hand off the published contract `e3fbc8b8` + +### Register Playwright human and agent consumers through governed identity delivery +Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377` + +**Open tasks:** +- ! Verify issuer and real consumer acceptance `5a3aaf57` + *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)* +- ► Deliver custody integration and guarded registration activation `a9dadd07` + +### Remove bootstrap secret output and verify separated recovery custody +Progress: 26/38 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804` + +**Open tasks:** +- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3` + *(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)* +- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00` + *(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)* +- ! Verify current caller and provider admission at their actual boundaries `77aa42be` + *(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)* +- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7` + *(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)* +- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773` + *(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)* +- ! Prove restored Authelia storage and OIDC continuity `b47f9975` + *(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)* +- ! Prepare the exact owner-held KeyCape recovery attempt `56c8d469` + *(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)* +- … and 5 more open tasks + +### Establish SecurityCaseTypes so that known security cases are light +Progress: 25/31 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb` + +**Open tasks:** +- ! T05 — Acknowledge the type through informed-decision `d9b26bcf` + *(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)* +- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae` + *(wait: The next types follow once the first one is proven end to end.)* +- ! T15 — Define authenticated recovery for lost registration process state `1b825705` + *(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)* +- ► T14 — Admit governed group rollback against native owner boundaries `fce95440` +- · T12 — Prepare NetKingdom-owned attended step adapters `7ce4eee3` +- · T16 — Select and review the actual machine descriptor composition `200bf500` + +### Define an execution-attribution receipt for Railiance runs +Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487` + +**Open tasks:** +- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1` + *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)* + +### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker +Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07` + +**Open tasks:** +- ! Admit the database consumer `2fe6f100` + *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)* +- ! Package the broker deployment `32d1411b` + *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)* +- ! Integrate an upstream identity provider `6697a994` + *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)* +- ! Define federated assurance `d845380d` + *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)* +- ! Verify IAM conformance and coexistence `9cb7fd93` + *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)* +- ! Enforce tenant and platform boundaries `38998c68` + *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)* +- ! Prove recovery and audit delivery `e5f44ddc` + *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)* +- … and 1 more open tasks + +--- +## MCP Orientation (when available) + +If the state-hub MCP server is reachable, call: +`get_domain_summary("infotech")` +This provides richer cross-domain context. +If the MCP call fails, use this file as your orientation source. diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/publication-backup/WORK-RECORDS.md.worktree new file mode 100644 index 00000000..4eda3538 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/publication-backup/WORK-RECORDS.md.worktree @@ -0,0 +1,289 @@ +# Work Records — net-kingdom + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md | +| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md | +| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md | +| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md | +| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md | +| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md | +| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md | +| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md | +| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md | +| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md | +| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md | +| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md | +| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | +| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | +| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | +| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md | +| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md | +| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md | +| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md | +| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md | +| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md | +| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md | +| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md | +| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md | +| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md | +| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md | +| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md | +| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | +| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | +| intake | NET-IN-0001 | open | — | intakes/intakes.md | +| intake | NET-IN-0002 | open | — | intakes/intakes.md | +| intake | NET-IN-0003 | open | — | intakes/intakes.md | +| intake | NET-IN-0004 | open | — | intakes/intakes.md | diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/publication-backup/originals.json new file mode 100644 index 00000000..1e3b06c0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/publication-backup/originals.json @@ -0,0 +1,10 @@ +[ + { + "path": ".custodian-brief.md", + "index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md" + }, + { + "path": "WORK-RECORDS.md", + "index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md" + } +] diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/apply_refinement.py b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/apply_refinement.py new file mode 100644 index 00000000..872cb773 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/apply_refinement.py @@ -0,0 +1,64 @@ +"""Record proved compatibility findings and the real remaining owner work.""" +from pathlib import Path +import hashlib +import json +import re +import subprocess +import sys + +HERE = Path(__file__).resolve().parent +ROOT = Path('/home/worsch/net-kingdom') +PLAN = 'workplans/NK-WP-0048-security-case-types.md' +BASE = '0241070b914d62b6ee483d61d587ee9a8e7152f0' + + +def sha(raw): + return hashlib.sha256(raw).hexdigest() + + +def git(*args): + return subprocess.check_output(['git', '-C', str(ROOT), *args], + stderr=subprocess.PIPE, timeout=40).decode().strip() + + +assert git('rev-parse', 'HEAD') == BASE +assert git('ls-remote', 'origin', 'refs/heads/main').split()[0] == BASE +before = (ROOT / PLAN).read_bytes() +assert sha(before) == '85b177f81dc88d3d04539f5d64c1b463ce0f64da5a6e37820e906e3f1620a4c7' +blocks = re.findall(rb'```task\n.*?```', before, re.S) +assert len(blocks) == 37 +assert b'id: NK-WP-0048-T38' not in before and b'id: NK-WP-0048-T39' not in before +dirty = set(git('diff', '--name-only').splitlines() + git('diff', '--cached', '--name-only').splitlines()) +assert dirty == {'.custodian-brief.md', 'WORK-RECORDS.md'} +originals = {p: {'worktree': sha((ROOT / p).read_bytes()), 'index': git('ls-files', '--stage', '--', p)} for p in dirty} +sys.path.insert(0, '/home/worsch/repo-manager/src') +from repo_manager.identifiers import ensure_missing_work_record_identifiers +preview = ensure_missing_work_record_identifiers(ROOT, execute=False) +assert preview['ok'] and not preview['assignments'] and not preview['files_changed'] +(ROOT / PLAN).write_bytes(before + (HERE / 'task-additions.md').read_bytes()) +preview = ensure_missing_work_record_identifiers(ROOT, execute=False) +(HERE / 'identifier-preview.json').write_text(json.dumps(preview, indent=2) + '\n') +assert preview['ok'] and preview['files_changed'] == [PLAN] +assert {r['record_id'] for r in preview['assignments']} == {'NK-WP-0048-T38', 'NK-WP-0048-T39'} +assigned = ensure_missing_work_record_identifiers(ROOT, execute=True) +(HERE / 'identifier-assignment.json').write_text(json.dumps(assigned, indent=2) + '\n') +after = (ROOT / PLAN).read_bytes() +assert re.findall(rb'```task\n.*?```', after, re.S)[:37] == blocks +assert len(re.findall(rb'```task\n.*?```', after, re.S)) == 39 +for p, old in originals.items(): + assert sha((ROOT / p).read_bytes()) == old['worktree'] + assert git('ls-files', '--stage', '--', p) == old['index'] +files = [{'path': PLAN, 'sha256': sha(after)}] +(HERE / 'publication-inputs.json').write_text(json.dumps({ + 'owner': 'net-kingdom', 'base_revision': BASE, + 'message': 'Record compiled any-of consumer source and actual release follow-through', + 'files': files}, indent=2) + '\n') +(HERE / 'source-refinement.json').write_text(json.dumps({ + 'base': BASE, 'files': files, 'original_task_blocks_preserved': 37, + 'source_task_count': 39, 'new_tasks': {'NK-WP-0048-T38': 'done', 'NK-WP-0048-T39': 'todo'}, + 'unrelated_state': originals, 'new_ids': assigned['assignments'], + 'knowledge': {'version': '0.2.6', 'digest': 'sha256:8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02', + 'status': 'withheld/orientation-only; actual INTENT and SECURITY-COMPANION reviewed'}, + 'native_or_credential_actions': False}, indent=2) + '\n') +print(json.dumps({'status': 'source_refined', 'original_task_blocks_preserved': 37, + 'source_task_count': 39, 'normal_allocator_assignments': len(assigned['assignments'])})) diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/consistency.json b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/consistency.json new file mode 100644 index 00000000..71fba879 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/consistency.json @@ -0,0 +1,364 @@ +{ + "repo_slug": "net-kingdom", + "repo_path": "/home/worsch/net-kingdom", + "source_revision": "6201a1d2de282a218fde8d81b32f790a526942ef", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-24", + "message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['NET-WP', 'NK-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0011' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0011-enterprise-federation-saml.md", + "db_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub", + "file_path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md", + "db_id": "", + "file_value": "USER-WP-0020", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0004' is not linked to State Hub", + "file_path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md", + "db_id": "", + "file_value": "KEY-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub", + "file_path": "workplans/NK-WP-0023-user-engine-portal-platform-integration.md", + "db_id": "", + "file_value": "USER-WP-0020", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0004' is not linked to State Hub", + "file_path": "workplans/NK-WP-0023-user-engine-portal-platform-integration.md", + "db_id": "", + "file_value": "KEY-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0021' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "USER-WP-0021", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'FLEX-WP-0009' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "FLEX-WP-0009", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'AUDIT-WP-0003' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "AUDIT-WP-0003", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'EMAIL-WP-0004' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "EMAIL-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0022' is not linked to State Hub", + "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md", + "db_id": "", + "file_value": "USER-WP-0022", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0008' is not linked to State Hub", + "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md", + "db_id": "", + "file_value": "KEY-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'CSOC-WP-0003' is not linked to State Hub", + "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md", + "db_id": "", + "file_value": "CSOC-WP-0003", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0027' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0027-reef-placement-reconciliation.md", + "db_id": "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0031' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0031-deterministic-posture-feedback.md", + "db_id": "9d7b04f9-3803-5613-b7a5-8bd606c77f5a", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0040' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0040-execution-attribution-receipt.md", + "db_id": "e2533f3a-aa43-59b3-bff3-8e64b6149487", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'NK-WP-0048-T15' in workplan 'NK-WP-0048' \u2014 every depends_on target is terminal (NK-WP-0048-T31)", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T15", + "db_id": "", + "file_value": "NK-WP-0048-T31", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'NK-WP-0048-T38' is absent from this projection", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T38", + "db_id": "2c32b963-a87c-50a1-91e1-b07ea1fe4960", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'NK-WP-0048-T38' of task 'NK-WP-0048-T39' is not linked to State Hub", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T39", + "db_id": "", + "file_value": "NK-WP-0048-T38", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'NK-WP-0048-T39' is absent from this projection", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T39", + "db_id": "513c43ae-05f2-5a65-9c80-a911b7d680b8", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAIL-PL-WP-0002' is not linked to State Hub", + "file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0002", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'nk-wp-0035@retired-20260908' (id=064c5e8b\u2026, status=archived) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "064c5e8b-7852-4d7f-a5fa-e26e406ab8e0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-08-14@retired-20260827' (id=a5097121\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "a5097121-1461-59f8-81fa-e6ecef527337", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-08-23@retired-20260827' (id=e25ba5fa\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "e25ba5fa-eaae-5039-8d93-a69c6d837fc4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'net-kingdom-adhoc-2026-07-02@retired-20260827' (id=67c1c7ac\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "67c1c7ac-d8b1-41dc-a81a-4e43f1afd068", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'net-kingdom-adhoc-2026-06-14@retired-20260827' (id=c6f3d6bf\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "c6f3d6bf-4916-490d-96ce-092d2776d7e7", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0020' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md", + "db_id": "", + "file_value": "NET-WP-0020", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0015' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260603-NET-WP-0015-platform-root-custody-and-openbao-identity-bootstrap.md", + "db_id": "", + "file_value": "NET-WP-0015", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0016' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260603-NET-WP-0016-guided-security-bootstrap-experience.md", + "db_id": "", + "file_value": "NET-WP-0016", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0018' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260604-NET-WP-0018-bootstrap-automation-and-rebuild-readiness.md", + "db_id": "", + "file_value": "NET-WP-0018", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0017' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md", + "db_id": "", + "file_value": "NET-WP-0017", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0019' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-NET-WP-0019-t06-adjacent-user-lifecycle-dry-run-polish.md", + "db_id": "", + "file_value": "NET-WP-0019", + "db_value": "NK-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 64/64", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-33 fixed: regenerated WORK-RECORDS.md", + "C-11 fixed: task 'NK-WP-0048-T38' \u2192 2c32b963\u2026", + "C-11 fixed: task 'NK-WP-0048-T39' \u2192 513c43ae\u2026", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 29, + "info": 5 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/consistency.stderr.txt new file mode 100644 index 00000000..3345563f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/consistency.stderr.txt @@ -0,0 +1 @@ +WARN: git commit failed for writeback: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/identifier-assignment.json b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/identifier-assignment.json new file mode 100644 index 00000000..03f61f23 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/identifier-assignment.json @@ -0,0 +1,26 @@ +{ + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "net-kingdom", + "namespace": "helixforge", + "assignments": [ + { + "kind": "task", + "record_id": "NK-WP-0048-T38", + "uuid": "2c32b963-a87c-50a1-91e1-b07ea1fe4960", + "path": "workplans/NK-WP-0048-security-case-types.md" + }, + { + "kind": "task", + "record_id": "NK-WP-0048-T39", + "uuid": "513c43ae-05f2-5a65-9c80-a911b7d680b8", + "path": "workplans/NK-WP-0048-security-case-types.md" + } + ], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [ + "workplans/NK-WP-0048-security-case-types.md" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/identifier-preview.json b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/identifier-preview.json new file mode 100644 index 00000000..5e21b277 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/identifier-preview.json @@ -0,0 +1,26 @@ +{ + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": false, + "repo": "net-kingdom", + "namespace": "helixforge", + "assignments": [ + { + "kind": "task", + "record_id": "NK-WP-0048-T38", + "uuid": "2c32b963-a87c-50a1-91e1-b07ea1fe4960", + "path": "workplans/NK-WP-0048-security-case-types.md" + }, + { + "kind": "task", + "record_id": "NK-WP-0048-T39", + "uuid": "513c43ae-05f2-5a65-9c80-a911b7d680b8", + "path": "workplans/NK-WP-0048-security-case-types.md" + } + ], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [ + "workplans/NK-WP-0048-security-case-types.md" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/projection.json b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/projection.json new file mode 100644 index 00000000..f1415a3d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-consumer-gate-implementation-r1/projection.json @@ -0,0 +1,1001 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "net-kingdom", + "commit": "6201a1d2de282a218fde8d81b32f790a526942ef", + "requests": 2, + "elapsed_ms": 12268.2, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "net-kingdom", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "6201a1d2de282a218fde8d81b32f790a526942ef", + "derived_commit": "6201a1d2de282a218fde8d81b32f790a526942ef", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "net-kingdom", + "commit": "6201a1d2de282a218fde8d81b32f790a526942ef", + "status": "applied", + "counts": { + "created": 0, + "updated": 64, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 2, + "cancelled_tasks": 0, + "created_edges": 1, + "removed_edges": 0, + "unresolved_edges": 1, + "external_edges": 85 + }, + "created": [], + "updated": [ + "NET-WP-0015", + "NET-WP-0016", + "NET-WP-0017", + "NET-WP-0018", + "NET-WP-0019", + "NET-WP-0020", + "NK-WP-0001", + "NK-WP-0002", + "NK-WP-0003", + "NK-WP-0004", + "NK-WP-0005", + "NK-WP-0006", + "NK-WP-0007", + "NK-WP-0008", + "NK-WP-0009", + "NK-WP-0010", + "NK-WP-0011", + "NK-WP-0012", + "NK-WP-0013", + "NK-WP-0014", + "NK-WP-0015", + "NK-WP-0016", + "NK-WP-0017", + "NK-WP-0018", + "NK-WP-0019", + "NK-WP-0021", + "NK-WP-0022", + "NK-WP-0023", + "NK-WP-0024", + "NK-WP-0025", + "NK-WP-0026", + "NK-WP-0027", + "NK-WP-0028", + "NK-WP-0029", + "NK-WP-0030", + "NK-WP-0031", + "NK-WP-0032", + "NK-WP-0033", + "NK-WP-0034", + "NK-WP-0035", + "NK-WP-0036", + "NK-WP-0037", + "NK-WP-0038", + "NK-WP-0039", + "NK-WP-0040", + "NK-WP-0041", + "NK-WP-0042", + "NK-WP-0043", + "NK-WP-0044", + "NK-WP-0045", + "NK-WP-0046", + "NK-WP-0047", + "NK-WP-0048", + "NK-WP-0049", + "NK-WP-0050", + "NK-WP-0051", + "NK-WP-ADHOC-2026-06-14", + "NK-WP-ADHOC-2026-07-02", + "NK-WP-ADHOC-2026-08-14", + "NK-WP-ADHOC-2026-08-23", + "NK-WP-ADHOC-2026-10-03", + "NK-WP-ADHOC-2026-10-10", + "NK-WP-ADHOC-2026-10-11", + "NK-WP-ADHOC-2026-10-16" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [ + "NK-WP-0048-T38", + "NK-WP-0048-T39" + ], + "cancelled_tasks": [], + "created_edges": [ + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T39", + "target": "NK-WP-0048-T38", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "513c43ae-05f2-5a65-9c80-a911b7d680b8", + "to_workplan_id": null, + "to_task_id": "2c32b963-a87c-50a1-91e1-b07ea1fe4960" + } + ], + "removed_edges": [], + "unresolved_edges": [ + { + "workplan": "NK-WP-0006", + "from": "NK-WP-0006", + "target": "NK-WP-0001", + "reason": "missing" + } + ], + "external_edges": [ + { + "workplan": "NK-WP-0008", + "from": "NK-WP-0008", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0050", + "from": "NK-WP-0050-T03", + "target": "RPF-WP-0056-T03", + "relationship_type": "starts_after", + "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377", + "from_task_id": "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e", + "to_workplan_id": null, + "to_task_id": "a82762eb-bb6d-5600-89ca-a81ada2eba9f" + }, + { + "workplan": "NK-WP-0050", + "from": "NK-WP-0050-T03", + "target": "NK-WP-0050-T02", + "relationship_type": "starts_after", + "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377", + "from_task_id": "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e", + "to_workplan_id": null, + "to_task_id": "a9dadd07-f136-5dc7-9229-7a9dbb941f0d" + }, + { + "workplan": "NK-WP-0050", + "from": "NK-WP-0050-T02", + "target": "NK-WP-0050-T01", + "relationship_type": "starts_after", + "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377", + "from_task_id": "a9dadd07-f136-5dc7-9229-7a9dbb941f0d", + "to_workplan_id": null, + "to_task_id": "64893d94-9717-5812-b8e3-7cabe095fcdc" + }, + { + "workplan": "NK-WP-0017", + "from": "NK-WP-0017", + "target": "NK-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "08398d26-cadf-44bc-97ee-67da790040e6", + "from_task_id": null, + "to_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011", + "target": "NK-WP-0003", + "relationship_type": "blocks", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": null, + "to_workplan_id": "f24cefd4-a09b-4fa1-9b25-94bf783b425e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T03", + "target": "NK-WP-0011-T02", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908", + "to_workplan_id": null, + "to_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T07", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T07", + "target": "NK-WP-0011-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833", + "to_workplan_id": null, + "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T07", + "target": "NK-WP-0011-T05", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833", + "to_workplan_id": null, + "to_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T04", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T06", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T06", + "target": "NK-WP-0011-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446", + "to_workplan_id": null, + "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T06", + "target": "NK-WP-0011-T05", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446", + "to_workplan_id": null, + "to_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T05", + "target": "NK-WP-0011-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d", + "to_workplan_id": null, + "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T09", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T09", + "target": "NK-WP-0011-T07", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e", + "to_workplan_id": null, + "to_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T09", + "target": "NK-WP-0011-T08", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e", + "to_workplan_id": null, + "to_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T08", + "target": "NK-WP-0011-T02", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d", + "to_workplan_id": null, + "to_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T08", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NET-WP-0016", + "from": "NET-WP-0016", + "target": "NET-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38", + "from_task_id": null, + "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "to_task_id": null + }, + { + "workplan": "NET-WP-0016", + "from": "NET-WP-0016", + "target": "NK-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38", + "from_task_id": null, + "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "to_task_id": null + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T18", + "target": "NK-WP-0049-T33", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "141dd773-c1fa-56c1-a852-bbe2372e5125", + "to_workplan_id": null, + "to_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T18", + "target": "NK-WP-0049-T32", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "141dd773-c1fa-56c1-a852-bbe2372e5125", + "to_workplan_id": null, + "to_task_id": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T35", + "target": "NK-WP-0049-T34", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "1bfd1703-589f-5511-bad5-812d860e4a71", + "to_workplan_id": null, + "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T35", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "1bfd1703-589f-5511-bad5-812d860e4a71" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T34", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T36", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "8b72334b-fc27-5707-a189-bad345eaf3bc" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T32", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T36", + "target": "NK-WP-0049-T34", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "8b72334b-fc27-5707-a189-bad345eaf3bc", + "to_workplan_id": null, + "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T03", + "target": "NK-WP-0049-T02", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac", + "to_workplan_id": null, + "to_task_id": "479d6970-6516-50f5-9436-bb5b56d58aad" + }, + { + "workplan": "NK-WP-0025", + "from": "NK-WP-0025", + "target": "NK-WP-0024", + "relationship_type": "blocks", + "from_workplan_id": "2412a251-d6b5-5f05-8082-3eb7697c51dc", + "from_task_id": null, + "to_workplan_id": "635a73d4-b3cb-5c38-af22-56a6a66beb0e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0016", + "from": "NK-WP-0016", + "target": "NK-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "2d592e18-e63d-4856-97a1-f8c3e019e150", + "from_task_id": null, + "to_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8", + "to_task_id": null + }, + { + "workplan": "NK-WP-0006", + "from": "NK-WP-0006", + "target": "NK-WP-0005", + "relationship_type": "blocks", + "from_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "from_task_id": null, + "to_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19", + "to_task_id": null + }, + { + "workplan": "NK-WP-0006", + "from": "NK-WP-0006", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0013", + "from": "NK-WP-0013", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "32a54d8e-8633-42a6-8ec1-104842c581c1", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0015", + "from": "NK-WP-0015", + "target": "NK-WP-0014", + "relationship_type": "blocks", + "from_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8", + "from_task_id": null, + "to_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c", + "to_task_id": null + }, + { + "workplan": "NET-WP-0017", + "from": "NET-WP-0017", + "target": "NET-WP-0016", + "relationship_type": "blocks", + "from_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "from_task_id": null, + "to_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38", + "to_task_id": null + }, + { + "workplan": "NET-WP-0017", + "from": "NET-WP-0017", + "target": "NET-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "from_task_id": null, + "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "to_task_id": null + }, + { + "workplan": "NK-WP-0007", + "from": "NK-WP-0007", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0007", + "from": "NK-WP-0007", + "target": "NK-WP-0005", + "relationship_type": "blocks", + "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695", + "from_task_id": null, + "to_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19", + "to_task_id": null + }, + { + "workplan": "NK-WP-0007", + "from": "NK-WP-0007", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0024", + "from": "NK-WP-0024", + "target": "NK-WP-0023", + "relationship_type": "blocks", + "from_workplan_id": "635a73d4-b3cb-5c38-af22-56a6a66beb0e", + "from_task_id": null, + "to_workplan_id": "fdb3deee-06c3-5d12-91ce-9c50b2ac0618", + "to_task_id": null + }, + { + "workplan": "NET-WP-0015", + "from": "NET-WP-0015", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NET-WP-0015", + "from": "NET-WP-0015", + "target": "NK-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "from_task_id": null, + "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "to_task_id": null + }, + { + "workplan": "NK-WP-0018", + "from": "NK-WP-0018", + "target": "NK-WP-0017", + "relationship_type": "blocks", + "from_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87", + "from_task_id": null, + "to_workplan_id": "08398d26-cadf-44bc-97ee-67da790040e6", + "to_task_id": null + }, + { + "workplan": "NK-WP-0018", + "from": "NK-WP-0018", + "target": "NK-WP-0016", + "relationship_type": "blocks", + "from_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87", + "from_task_id": null, + "to_workplan_id": "2d592e18-e63d-4856-97a1-f8c3e019e150", + "to_task_id": null + }, + { + "workplan": "NK-WP-0005", + "from": "NK-WP-0005", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NET-WP-0019", + "from": "NET-WP-0019", + "target": "NET-WP-0017", + "relationship_type": "blocks", + "from_workplan_id": "75d388b6-7ec1-4e1b-8c87-6ff44f953210", + "from_task_id": null, + "to_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "to_task_id": null + }, + { + "workplan": "NET-WP-0019", + "from": "NET-WP-0019", + "target": "NET-WP-0018", + "relationship_type": "blocks", + "from_workplan_id": "75d388b6-7ec1-4e1b-8c87-6ff44f953210", + "from_task_id": null, + "to_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698", + "to_task_id": null + }, + { + "workplan": "NET-WP-0018", + "from": "NET-WP-0018", + "target": "NET-WP-0017", + "relationship_type": "blocks", + "from_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698", + "from_task_id": null, + "to_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "to_task_id": null + }, + { + "workplan": "NET-WP-0018", + "from": "NET-WP-0018", + "target": "NET-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698", + "from_task_id": null, + "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "to_task_id": null + }, + { + "workplan": "NK-WP-0027", + "from": "NK-WP-0027-T03", + "target": "NK-WP-0027-T02", + "relationship_type": "starts_after", + "from_workplan_id": "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4", + "from_task_id": "e3f0bb0f-0c85-5cb9-a5ab-75f668cd3447", + "to_workplan_id": null, + "to_task_id": "5b35b646-a525-55da-852a-6005613d42ea" + }, + { + "workplan": "NK-WP-0012", + "from": "NK-WP-0012", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0014", + "from": "NK-WP-0014", + "target": "NK-WP-0013", + "relationship_type": "blocks", + "from_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c", + "from_task_id": null, + "to_workplan_id": "32a54d8e-8633-42a6-8ec1-104842c581c1", + "to_task_id": null + }, + { + "workplan": "NK-WP-0014", + "from": "NK-WP-0014", + "target": "NK-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c", + "from_task_id": null, + "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "to_task_id": null + }, + { + "workplan": "NK-WP-0019", + "from": "NK-WP-0019", + "target": "NK-WP-0018", + "relationship_type": "blocks", + "from_workplan_id": "d2daa8b4-8ecf-4377-b382-492e653735f7", + "from_task_id": null, + "to_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87", + "to_task_id": null + }, + { + "workplan": "NK-WP-0009", + "from": "NK-WP-0009", + "target": "NK-WP-0008", + "relationship_type": "blocks", + "from_workplan_id": "d4d02dbf-3974-502d-8b87-b776fc63e17e", + "from_task_id": null, + "to_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d", + "to_task_id": null + }, + { + "workplan": "NK-WP-0022", + "from": "NK-WP-0022", + "target": "NK-WP-0023", + "relationship_type": "blocks", + "from_workplan_id": "d76ddccc-00c8-548a-b141-2cd660fa38da", + "from_task_id": null, + "to_workplan_id": "fdb3deee-06c3-5d12-91ce-9c50b2ac0618", + "to_task_id": null + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T15", + "target": "NK-WP-0048-T31", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "1b825705-4848-5edc-832f-b1622cd9bdb7", + "to_workplan_id": null, + "to_task_id": "ed1ccd87-89a0-5e69-885c-0eaf5ab0bb5a" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T25", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "0de2a7d9-874d-578b-a076-f653fe42e30b" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T29", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "129db41d-4560-5e20-9f3b-c3c91e0a5601" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T24", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "1a3931ee-3b5f-52fc-9295-4073804f4bd2" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T28", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "6dab281c-ea9a-5a17-a83f-e8e9a4d4484f" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T30", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "6f6073ac-52dd-5b70-8874-6d76d4c072e4" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T26", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "94b3cbf0-c908-5ac6-b0db-67385c3e021c" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T27", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "e56365f8-29b5-5c89-a329-8115f9f3b2a7" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T07", + "target": "NK-WP-0048-T06", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "c3c9c3ae-4f23-5ba7-9e6f-e63bcf29b9f7", + "to_workplan_id": null, + "to_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T09", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "0ee12dfc-8260-5038-bd39-cc7fb4113be0" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T15", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "1b825705-4848-5edc-832f-b1622cd9bdb7" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T16", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T05", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "3d987d3d-0797-538b-86e4-51185a327ae2" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "MASON-WP-0010-T03", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "56cea6be-c613-586c-80cd-125340b374da" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T12", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "7ce4eee3-cd47-55a9-bfa5-4f1835d4d6fd" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T20", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T17", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "8c3e4baa-a218-5996-af9e-fe1153a46dac" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T08", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "8e519082-dc8b-5e46-b660-03d03e55dcf6" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T18", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "9c45da71-fb4c-5f20-9065-90f448f37c64" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T13", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "b264c10b-565c-5d29-b788-03cf5fbd2883" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "WARDEN-WP-0044-T03", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T14", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "fce95440-a25b-5f27-8ef3-a3d182099113" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T14", + "target": "NK-WP-0048-T20", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "fce95440-a25b-5f27-8ef3-a3d182099113", + "to_workplan_id": null, + "to_task_id": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8" + }, + { + "workplan": "NK-WP-0010", + "from": "NK-WP-0010", + "target": "NK-WP-0008", + "relationship_type": "blocks", + "from_workplan_id": "f4faf8b4-ae57-40cf-a881-6fe66ca6ad74", + "from_task_id": null, + "to_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d", + "to_task_id": null + } + ], + "refused": [], + "notes": [] + } + } +}